SQL Injection Vulnerability in Hypequery for ClickHouse

CVE-2026-54658

What is CVE-2026-54658?

Hypequery, a TypeScript semantic layer for ClickHouse, contains a vulnerability in the escapeValue() function found in packages/clickhouse/src/core/utils.ts. This flaw permits attacker-controlled query parameters that include a trailing backslash to bypass intended protections, leading to potential SQL injection attacks. The issue arises from the failure to adequately escape backslashes before single quotes during parameter substitution. To mitigate this risk, users are encouraged to upgrade to version 2.0.2 or later, in which this vulnerability has been addressed.

References