CVE-2026-54658

Summary

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

Severity

critical

CVSS

9.8

EPSS

0.8% (p57)

CWE

CWE-89

Also known as

GHSA-6wcc-39rp-hh9p

Published

2026-07-28

Updated

2026-07-28

Advisory details

Impact

A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote.

Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters.

Patches

The vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes

Workarounds

No workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.

References

• https://github.com/advisories/GHSA-6wcc-39rp-hh9p
• https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
• https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
• https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202
• https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2

Related advisories

• CVE-2026-105845 — critical · npm/payload
• CVE-2026-69085 — critical · Go/github.com/siyuan-note/siyuan/kernel
• CVE-2026-79752 — critical · Packagist/cakephp/database
• CVE-2026-75513 — critical · NuGet/Marten
• CVE-2026-77635 — critical · Packagist/cakephp/cakephp
• CVE-2026-72811 — critical · Go/github.com/siyuan-note/siyuan/kernel
• CVE-2026-71867 — critical · npm/orval
• CVE-2026-71866 — critical · npm/orval

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity