CVE-2026-54658
Hypequery, a TypeScript layer for ClickHouse, had a flaw that let attackers inject SQL by sending a parameter ending with a backslash. The bug was fixed in version 2.0.2.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of Hypequery versions earlier than 2.0.2 who rely on it to build ClickHouse queries.
Real-world impact
An attacker could inject arbitrary SQL, potentially reading, modifying, or deleting data in the ClickHouse database, or escalating privileges if the database user has higher rights.
Why this severity
The vulnerability allows unauthenticated attackers to execute any SQL command because the missing escape turns a user‑supplied value into executable code, giving full control over the database. This is why the CVSS score is 9.8.
What to do about it
- 01Upgrade Hypequery to version 2.0.2 or later.
NVD-referenced vendor advisory
Timeline
- Jul 28, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.