{"id":"CVE-2026-54658","aliases":["GHSA-6wcc-39rp-hh9p"],"title":"@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution","summary":"@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution","severity":"critical","cvss":9.8,"cwe":["CWE-89"],"vendor":"hypequery","product":"@hypequery/clickhouse","ecosystem":"npm","affected":["@hypequery/clickhouse < 2.0.2"],"patched":["@hypequery/clickhouse 2.0.2"],"published":"2026-07-28","updated":"2026-07-28","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6wcc-39rp-hh9p","references":[{"url":"https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p"},{"url":"https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf"},{"url":"https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202"},{"url":"https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2"},{"url":"https://github.com/advisories/GHSA-6wcc-39rp-hh9p"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-28T22:40:03.202Z","epss":0.00465,"epssPercentile":0.39505,"slug":"CVE-2026-54658","body":"## Overview\n\n### Impact\n A SQL injection vulnerability exists in the `escapeValue()` function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote.\n\nWho is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters.\n\n### Patches\nThe vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes\n\n### Workarounds\nNo workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.\n\n## Affected packages\n\n- `@hypequery/clickhouse < 2.0.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@hypequery/clickhouse 2.0.2`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}