PT-2026-65620
CVE-2026-54658
·
Published
2026-07-28
·
Updated
2026-08-04
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Hypequery versions prior to 2.0.2
Description
A SQL injection issue exists in the
escapeValue() function within the packages/clickhouse/src/core/utils.ts file. The function fails to escape backslashes before single quotes during parameter substitution. This allows an attacker to provide query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL commands.Recommendations
Update to version 2.0.2.
Found an issue in the description? Have something to add? Feel free to write us 👾