{"id":"CVE-2026-54658","summary":"@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution","details":"Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL. This issue is fixed in version 2.0.2. Version 2.0.2 fixes string parameters, while version 2.5.1 fixes all known vectors. Upgrading to 2.5.1 or later is the only complete fix. In versions 2.0.2 through 2.5.0, serializing non-scalar parameters with  JSON.stringify()  before passing them is a workaround for the object/array vector only.","aliases":["GHSA-6wcc-39rp-hh9p"],"modified":"2026-10-28T02:31:11.524421462Z","published":"2026-07-28T22:18:48.800Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54658.json"},"references":[{"type":"WEB","url":"https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202"},{"type":"WEB","url":"https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2"},{"type":"WEB","url":"https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.5.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54658.json"},{"type":"ADVISORY","url":"https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54658"},{"type":"FIX","url":"https://github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff05510976960"},{"type":"FIX","url":"https://github.com/hypequery/hypequery/commit/2dc1df7bae"},{"type":"FIX","url":"https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf"},{"type":"FIX","url":"https://github.com/hypequery/hypequery/pull/349"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hypequery/hypequery","events":[{"introduced":"0"},{"fixed":"e62282f435943689215b96c64a7ca493b75334ae"},{"fixed":"2879161a810fed2c2222f785816ff05510976960"},{"fixed":"2dc1df7bae"},{"fixed":"4dfa9d77d70a08b970e722268b75ca7d13db0bdf"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"2.5.1"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"2879161a810fed2c2222f785816ff05510976960"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"2dc1df7bae"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"4dfa9d77d70a08b970e722268b75ca7d13db0bdf"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["@hypequery/cli@1.10.1","@hypequery/studio@0.2.0","@hypequery/serve@0.14.0","@hypequery/protocol-conformance@0.9.0","@hypequery/gateway@0.2.0","@hypequery/clickhouse@2.5.0","@hypequery/cli@1.10.0","@hypequery/serve@0.13.7","@hypequery/mcp@0.5.4","@hypequery/datasets@0.13.0","@hypequery/serve@0.13.6","@hypequery/protocol@0.9.0","@hypequery/deployment@0.5.1","@hypequery/datasets@0.12.7","@hypequery/cli@1.9.5","@hypequery/serve@0.13.5","@hypequery/protocol@0.8.0","@hypequery/deployment@0.5.0","@hypequery/datasets@0.12.6","@hypequery/cli@1.9.4","@hypequery/serve@0.13.4","@hypequery/protocol@0.7.0","@hypequery/deployment@0.4.0","@hypequery/datasets@0.12.5","@hypequery/cli@1.9.3","@hypequery/deployment@0.3.0","@hypequery/cli@1.9.2","@hypequery/serve@0.13.3","@hypequery/protocol@0.6.0","@hypequery/deployment@0.2.0","@hypequery/datasets@0.12.4","@hypequery/cli@1.9.1","@hypequery/deployment@0.1.0","@hypequery/cli@1.9.0","@hypequery/serve@0.13.2","@hypequery/protocol@0.5.0","@hypequery/datasets@0.12.3","@hypequery/cli@1.8.0","@hypequery/serve@0.13.1","@hypequery/protocol@0.4.0","@hypequery/datasets@0.12.2","@hypequery/cli@1.7.0","@hypequery/serve@0.13.0","@hypequery/cli@1.6.0","@hypequery/serve@0.12.0","@hypequery/protocol@0.3.0","@hypequery/datasets@0.12.1","@hypequery/cli@1.5.0","@hypequery/protocol@0.2.1","@hypequery/serve@0.11.0","@hypequery/protocol@0.2.0","@hypequery/mcp@0.5.3","@hypequery/datasets@0.12.0","@hypequery/cli@1.4.0","@hypequery/serve@0.10.0","@hypequery/serve@0.9.2","@hypequery/mcp@0.5.2","@hypequery/datasets@0.11.0","@hypequery/protocol@0.1.0","@hypequery/serve@0.9.1","@hypequery/mcp@0.5.1","@hypequery/datasets@0.10.0","@hypequery/clickhouse@2.4.0","@hypequery/clickhouse@2.3.0","@hypequery/serve@0.9.0","@hypequery/mcp@0.5.0","@hypequery/datasets@0.9.0","@hypequery/clickhouse@2.2.0","@hypequery/serve@0.8.1","@hypequery/clickhouse@2.1.3","@hypequery/cli@1.3.1","@hypequery/serve@0.8.0","@hypequery/react@0.5.0","@hypequery/mcp@0.4.5","@hypequery/datasets@0.8.0","@hypequery/serve@0.7.0","@hypequery/mcp@0.4.4","@hypequery/datasets@0.7.0","@hypequery/serve@0.6.1","@hypequery/mcp@0.4.3","@hypequery/datasets@0.6.0","@hypequery/serve@0.6.0","@hypequery/mcp@0.4.2","@hypequery/datasets@0.5.0","@hypequery/cli@1.3.0","@hypequery/cli@1.2.1","@hypequery/clickhouse@2.1.2","@hypequery/serve@0.5.0","@hypequery/mcp@0.4.1","@hypequery/datasets@0.4.0","@hypequery/serve@0.4.0","@hypequery/mcp@0.4.0","@hypequery/datasets@0.3.0","@hypequery/clickhouse@2.1.1","@hypequery/mcp@0.3.0","@hypequery/datasets@0.2.1","@hypequery/serve@0.3.0","@hypequery/schema@0.1.0","@hypequery/react@0.2.0","@hypequery/mcp@0.2.0","@hypequery/datasets@0.2.0","@hypequery/clickhouse@2.1.0","@hypequery/cli@1.2.0","@hypequery/clickhouse@2.0.1","@hypequery/mcp@0.1.0","@hypequery/mcp-server@0.1.0","@hypequery/serve@0.2.1","@hypequery/clickhouse@2.0.0","@hypequery/cli@1.1.2","@hypequery/cli@1.1.1","@hypequery/clickhouse@1.6.2","@hypequery/clickhouse@1.6.1","@hypequery/serve@0.2.0","@hypequery/cli@1.1.0","@hypequery/clickhouse@1.6.0","@hypequery/cli@1.0.0","@hypequery/serve@0.1.1","@hypequery/react@0.1.1","@hypequery/serve@0.1.0","@hypequery/react@0.1.0","@hypequery/serve@0.0.9","@hypequery/react@0.0.3","@hypequery/cli@0.0.9","@hypequery/clickhouse@1.5.0","serve-v0.0.1","react-v0.0.1","cli-v0.0.1","v1.4.0","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.2.10","v1.2.9","v1.2.8","v1.2.7","v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.1.4","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v1.0.0","v0.2.5","v0.2.4","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54658.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}