CVE-2026-54658: SQL Injection via Parameter Escaping Bypass in @hypequery/clickhouse

Vulnerability ID: CVE-2026-54658
CVSS Score: 9.8
Published: 2026-07-28

A critical SQL injection vulnerability was identified in @hypequery/clickhouse prior to version 2.0.2. The escapeValue utility function in packages/clickhouse/src/core/utils.ts fails to escape literal backslash characters before replacing single quotes. This allows remote, unauthenticated attackers to supply input parameters ending in a backslash, neutralizing the closing quote character inside ClickHouse databases and enabling arbitrary SQL execution.

TL;DR

Improper escaping of trailing backslash characters in @hypequery/clickhouse parameter substitution allows attackers to escape string literal boundaries and inject arbitrary SQL commands into ClickHouse queries.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-89
• Attack Vector: Network (AV:N)
• CVSS Severity: 9.8 (Critical)
• Exploit Status: PoC (Proof of Concept) available in repository tests
• CISA KEV Status: Not listed
• Mitigated Version: 2.0.2

Affected Systems

• @hypequery/clickhouse
• @hypequery/clickhouse: < 2.0.2 (Fixed in: 2.0.2)

Code Analysis

Commit: 4dfa9d7

Fix escapeValue to correctly double escape backslashes before escaping single quotes in @hypequery/clickhouse

@@ -5,3 +5,3 @@ export function escapeValue(value: any): string {
   } else if (typeof value === 'string') {
-    return `'${value.replace(/'/g, "''")}'`;
+    const escaped = value.replace(/\\/g, '\\\\').replace(/'/g, "''");
+    return `'${escaped}'`;

Mitigation Strategies

• Upgrade the dependency @hypequery/clickhouse to version 2.0.2 or higher immediately.
• Apply least-privilege principles to database connections, restricting write, modify, and drop permissions for application service roles.
• Deploy Web Application Firewall (WAF) signatures to block incoming HTTP requests with parameter values containing unescaped trailing backslashes.

Remediation Steps:

1. Open the project package.json file and locate the dependency entry for @hypequery/clickhouse.
2. Update the version number to at least 2.0.2.
3. Run your package manager install command (e.g., npm install or yarn install) to pull down and link the patched library version.
4. Verify the changes by checking package-lock.json or yarn.lock to confirm the installed package is 2.0.2.

References

• CVE Official Record
• GitHub Security Advisory GHSA-6wcc-39rp-hh9p
• Official Security Patch Commit
• Release Changelog
• Release Page

Read the full report for CVE-2026-54658 on our website for more details including interactive diagrams and full exploit analysis.