Loading story…
A critical SQL injection flaw tracked as CVE-2026-54658 was disclosed in @hypequery/clickhouse, the TypeScript semantic layer for ClickHouse. The vulnerability affects versions prior to 2.0.2 and stems from improper parameter escaping in the escapeValue() function, which escaped single quotes but failed to escape backslashes first. An attacker controlling query parameters could supply a trailing backslash to escape the closing quote in a ClickHouse string literal and inject arbitrary SQL, resulting in potential compromise of confidentiality, integrity, and availability.
The maintainers patched the issue in version 2.0.2 by escaping backslashes before single quotes and added tests covering trailing backslashes, multiple backslashes, mixed backslash-and-quote cases, and multi-parameter injection attempts. The fix was published in the project commit, release notes, and changelog, which urge users to upgrade immediately; the disclosure also credits Coby Geralnik (@astelia) for responsibly reporting the bug.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-28, CVE-2026-54658 was publicly listed as a high-severity SQL injection vulnerability affecting @hypequery/clickhouse versions prior to 2.0.2. The advisory described how a trailing backslash in controlled query parameters could break out of the closing quote and enable arbitrary SQL execution.
On 2026-06-08, Hypequery committed and released a fix for a SQL injection vulnerability in escapeValue() that failed to escape backslashes before single quotes. The patch updated the escaping logic, added tests for trailing-backslash and related injection cases, and urged users to upgrade to version 2.0.2.
The @hypequery/clickhouse 2.0.2 release credits Coby Geralnik (@astelia) with responsibly disclosing a SQL injection vulnerability in the package's parameter escaping logic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity SQL injection vulnerabilities were disclosed in **Kysely**, the TypeScript SQL query builder, affecting versions `0.28.12` and `0.28.13` in one case and versions prior to `0.28.14` in another. Both flaws stem from improper handling of backslashes in `DefaultQueryCompiler.sanitizeStringLiteral()`, which escaped single quotes but did not escape backslashes. In MySQL deployments using the default backslash-escape behavior, an attacker could place a backslash before a quote, break out of a string literal or JSON path string, and inject arbitrary SQL. Both issues are tracked as **CWE-89** and carry a **CVSS 3.1** score vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The first issue, **`CVE-2026-33442`**, affects non-type-safe usage of JSON path keys, while **`CVE-2026-33468`** impacts code paths that inline values into compiled SQL strings, including `sql.lit(string)`-style usage and components such as `CreateIndexBuilder.where()` and `CreateViewBuilder.as()` through `ImmediateValueTransformer`. GitHub security advisories were referenced for both disclosures, and the vendor fixed the vulnerabilities in **Kysely `0.28.14`**, making upgrade the primary remediation for affected MySQL-backed applications.
Jun 29, 2026
Metabase disclosed **CVE-2026-59827**, a critical unsafe deserialization vulnerability that can lead to remote code execution on the Metabase server when instances use an H2 database connection, including the default sample database. The flaw allows an authenticated user with permission to run native H2 queries to return query result columns of type `OTHER`, causing Metabase to deserialize arbitrary Java objects. The issue carries a **CVSS 9.9** rating and affects versions `1.58.0` through before `1.58.15`, `1.59.0` through before `1.59.12`, `1.60.0` through before `1.60.6.3`, and `1.61.0` through before `1.61.1.4`. A related Metabase code change in the H2 database driver shows the remediation path: the application now checks JDBC result metadata and rejects columns typed as `JAVA_OBJECT` instead of attempting to parse them. That defensive change blocks unsafe handling of serialized Java objects in H2 query results and aligns with the vendor fixes released in versions `1.58.15`, `1.59.12`, `1.60.6.3`, and `1.61.1.4`.
Jul 10, 2026
A critical SQL injection flaw tracked as **`CVE-2026-69240`** affects **Sequelize** when used with the **Oracle** database dialect, exposing applications that run versions prior to **`6.37.4`**. The vulnerability lies in the ORM's `sql-string.js` escape logic, which fails to properly escape quotes when a supplied string begins with Oracle function names such as **`TO_DATE`** or **`TO_TIMESTAMP`**, causing attacker-controlled input to be inserted directly into generated SQL queries. The issue is rated **CVSS 9.8** and can be exploited remotely without authentication, potentially allowing attackers to bypass application controls, read sensitive data, alter or delete records, and execute arbitrary SQL expressions. Reports warn that in Oracle deployments with elevated database privileges, the impact could extend beyond the database to filesystem access or operating system command execution, creating a path to full host compromise. The vendor has released a fix in **`Sequelize 6.37.4`** and advises affected users to upgrade immediately.
Aug 4, 2026