---
id: CVE-2026-54658
aliases:
  - GHSA-6wcc-39rp-hh9p
title: >-
  @hypequery/clickhouse has SQL Injection in parameter escaping that allows
  arbitrary SQL execution
summary: >-
  @hypequery/clickhouse has SQL Injection in parameter escaping that allows
  arbitrary SQL execution
severity: critical
cvss: 9.8
cwe:
  - CWE-89
vendor: hypequery
product: '@hypequery/clickhouse'
ecosystem: npm
affected:
  - '@hypequery/clickhouse < 2.0.2'
patched:
  - '@hypequery/clickhouse 2.0.2'
published: '2026-07-28'
updated: '2026-07-28'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-6wcc-39rp-hh9p'
references:
  - url: >-
      https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
  - url: >-
      https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
  - url: >-
      https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202
  - url: >-
      https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2
  - url: 'https://github.com/advisories/GHSA-6wcc-39rp-hh9p'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-28T22:40:03.202Z'
epss: 0.00816
epssPercentile: 0.55222
---

## Overview

### Impact
 A SQL injection vulnerability exists in the `escapeValue()` function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote.

Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters.

### Patches
The vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes

### Workarounds
No workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.

## Affected packages

- `@hypequery/clickhouse < 2.0.2`

## Remediation

Upgrade to a patched release:

- `@hypequery/clickhouse 2.0.2`