SQL Injection in @hypequery/clickhouse Parameter Escaping (CVE-2026-54658, CVSS 9.8)

A critical SQL injection vulnerability, tracked as CVE-2026-54658, has been disclosed for the npm package @hypequery/clickhouse via a GitHub Security Advisory (GHSA-6wcc-39rp-hh9p) published on 2026-07-28. According to the advisory, the flaw exists in the library's escapeValue() function, which is used to substitute parameters into ClickHouse queries. An attacker who can influence a parameter value can use a trailing backslash to escape the closing quote, breaking out of the intended string literal and injecting arbitrary SQL. The advisory rates the issue 9.8 (Critical) and notes it is patched in version 2.0.2, with proof-of-concept exploitation reportedly available.

Why It Matters

Per the advisory, this affects all users of @hypequery/clickhouse prior to 2.0.2 who pass user-controlled input as query parameters — a common pattern for any application exposing search, filtering, or reporting features backed by ClickHouse. Because the flaw is in the library's own escaping logic rather than application-level query construction, applications that believed they were using parameterization safely could still be exploitable. The advisory explicitly states that manual input validation or sanitization is not a reliable mitigation, since the underlying escaping is what's broken.

What Defenders Should Do Now

• Inventory applications and services that depend on @hypequery/clickhouse and confirm the installed version.
• Prioritize upgrading to 2.0.2 or later — the advisory states no viable workaround exists short of patching.
• Review recent logs for ClickHouse-backed applications for anomalous query patterns, unexpected multi-statement execution, or errors suggesting malformed SQL from user-supplied fields.
• As a hunting angle, look for inbound request parameters containing trailing backslash sequences targeting endpoints that accept ClickHouse query filters.
• Treat this as a supply-chain dependency risk — audit transitive dependencies in Node.js services for indirect use of this package.

Developing Intel

This is a same-day advisory and details may evolve as the community assesses real-world exploitability and downstream impact. Refer to the original GitHub Security Advisory for authoritative, up-to-date information: GHSA-6wcc-39rp-hh9p.