Executive brief
Hypequery is a software library used to translate data queries for ClickHouse databases. A security flaw in how the library handles user input allows attackers to bypass safety filters and run unauthorized database commands. This could lead to the theft of sensitive data, unauthorized modification of records, or a complete shutdown of the database service.
Technical details
A SQL injection vulnerability exists in the @hypequery/clickhouse library due to improper neutralization of special elements in the escapeValue() function. The root cause is that the function failed to escape backslashes before single quotes during parameter substitution. Because ClickHouse supports C-style escape sequences, an attacker can provide a parameter ending in a backslash to escape the library's closing quote, effectively breaking out of the string literal. This allows for the injection of arbitrary SQL commands over the network without authentication. The vulnerability is resolved in version 2.0.2 by ensuring backslashes are escaped first using a global regex replacement.
Affected products
- hypequery hypequery/clickhouse < 2.0.2
Timeline
- 2026-06-08: patched: Fix released in version 2.0.2
- 2026-06-08: advisory: GitHub Security Advisory GHSA-6wcc-39rp-hh9p published
- 2026-07-28: disclosed: CVE-2026-54658 published to NVD
References
- https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md
- https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2
- https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p