Loading vulnerability…
SQL Injection in @hypequery/clickhouse escapeValue()
CVE-2026-54658 is a SQL injection vulnerability in Hypequery's ClickHouse package affecting versions prior to 2.0.2. The flaw is in the escapeValue() function in packages/clickhouse/src/core/utils.ts during parameter substitution for string values. The implementation escaped single quotes by doubling them but did not escape literal backslashes first. Because ClickHouse interprets backslash-quote sequences as escaped quotes, an attacker-controlled parameter ending with a backslash can cause the intended closing quote to be treated as part of the string literal rather than as a delimiter. This leaves the string context open and allows subsequent attacker-controlled content to be parsed as SQL. The issue stems from an escaping mismatch between SQL-92 assumptions and ClickHouse string parsing behavior. Version 2.0.2 fixes the vulnerability by escaping backslashes before escaping single quotes.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary SQL injection against queries constructed through the vulnerable parameter substitution path. Depending on the privileges available to the ClickHouse connection and the surrounding application logic, an attacker may read sensitive data, modify or delete data, alter query logic, bypass intended filtering conditions, and potentially disrupt service availability through malicious queries. The assigned CVSS v3.1 vector indicates network-exploitable compromise with high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
No reliable workaround is available short of upgrading to a fixed release. Avoid relying on ad hoc input filtering or application-level sanitization to compensate for the library flaw. Where immediate upgrade is not possible, reduce exposure by preventing untrusted input from reaching vulnerable query construction paths and by restricting database account privileges to the minimum necessary, but these measures do not fully remediate the issue.
Patch, then assume compromise.
Upgrade @hypequery/clickhouse to version 2.0.2 or later. The fix changes string escaping behavior in escapeValue() so that backslashes are escaped before single quotes during parameter substitution, preventing attacker-controlled trailing backslashes from neutralizing the closing quote.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.