GHSA-6wcc-39rp-hh9p: @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

criticalCVSS 9.8CVE-2026-54658

Impact A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote. Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters. Patches The vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes Workarounds No workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.

Details

Source: GitHub Security Advisories (INTL · database · site)
Severity: critical — CVSS 9.8
Published: 2026-07-28
Last updated: 2026-07-28
Exploitation: Not in CISA KEV at last sync

Original advisory: https://github.com/advisories/GHSA-6wcc-39rp-hh9p

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-546580.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-54658	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

criticalCVE-2026-54658: Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in pack…nvd

GHSA-6wcc-39rp-hh9p: @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

Details

Exploitation outlook

Referenced CVEs

Same CVEs, other sources

More from GitHub Security Advisories