SQL Injection in @hypequery/clickhouse Allows Arbitrary ClickHouse Query Execution

A critical SQL injection flaw tracked as CVE-2026-54658 was disclosed in @hypequery/clickhouse, the TypeScript semantic layer for ClickHouse. The vulnerability affects versions prior to 2.0.2 and stems from improper parameter escaping in the escapeValue() function, which escaped single quotes but failed to escape backslashes first. An attacker controlling query parameters could supply a trailing backslash to escape the closing quote in a ClickHouse string literal and inject arbitrary SQL, resulting in potential compromise of confidentiality, integrity, and availability.

The maintainers patched the issue in version 2.0.2 by escaping backslashes before single quotes and added tests covering trailing backslashes, multiple backslashes, mixed backslash-and-quote cases, and multi-parameter injection attempts. The fix was published in the project commit, release notes, and changelog, which urge users to upgrade immediately; the disclosure also credits Coby Geralnik (@astelia) for responsibly reporting the bug.