CVE-2026-54658: @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote.
Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters.
References
- github.com/advisories/GHSA-6wcc-39rp-hh9p
- github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md
- github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
- github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2
- github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
- nvd.nist.gov/vuln/detail/CVE-2026-54658
Code Behaviors & Features
Detect and mitigate CVE-2026-54658 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →