CVE-2026-54658

criticalCVSS 9.8covered by 2 sourcesfirst seen 2026-07-28

Impact A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote. Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters. Patches The vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes Workarounds No workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.

⚡ Watch CVE-2026-54658

Get an email if CVE-2026-54658 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.

Advisory coverage (2)

criticalCVE-2026-54658: Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in pack…nvd · 2026-07-28
criticalGHSA-6wcc-39rp-hh9p: @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL e…ghsa · 2026-07-28

External references

NVD record for CVE-2026-54658

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-54658 status](https://www.csirts.com/badge/CVE-2026-54658)](https://www.csirts.com/cve/CVE-2026-54658)