Résumé
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Détails de l’avis
Impact
A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote.
Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters.
Patches
The vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes
Workarounds
No workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.
Références
- https://github.com/advisories/GHSA-6wcc-39rp-hh9p
- https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
- https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
- https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-72807
SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel
- CRITICALCVE-2026-72811
SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle
- CRITICALCVE-2026-71867
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
- CRITICALCVE-2026-71866
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
- HIGHCVE-2026-59834
SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
- MEDIUMCVE-2026-55855
MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets