CVE-2026-54658
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In Hypequery before version 2.0.2, the escapeValue() function did not escape backslashes before single quotes during parameter substitution, allowing an attacker to inject arbitrary SQL via query parameters with a trailing backslash.
Risk Assessment
An attacker can execute arbitrary SQL queries, leading to data leakage or modification in the ClickHouse database.
Recommendation
Update Hypequery to version 2.0.2 or later.
Original NVD description (English source)
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL. This issue is fixed in version 2.0.2.