CVE-2026-54658

🗓️ 28 Jul 2026 22:18:48Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 44 Views🌐 WEB

CVE-2026-54658: Hypequery ClickHouse escaping flaw allows SQL injection via trailing backslash; fixed in 2.0.2.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-54658	28 Jul 202622:18	–	attackerkb
Circl	CVE-2026-54658	28 Jul 202623:54	–	circl
Cvelist	CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution	28 Jul 202622:18	–	cvelist
EUVD	EUVD-2026-50086	28 Jul 202622:18	–	euvd
Github Security Blog	@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution	28 Jul 202622:19	–	github
NVD	CVE-2026-54658	28 Jul 202623:17	–	nvd
OSV	GHSA-6WCC-39RP-HH9P @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution	28 Jul 202622:19	–	osv
Positive Technologies	PT-2026-65620	28 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution	28 Jul 202622:18	–	vulnrichment

Vulners

Node

hypequery hypequeryRange<2.5.1

[
  {
    "vendor": "hypequery",
    "product": "hypequery",
    "versions": [
      {
        "version": "< 2.5.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
github	www.github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff05510976960
github	www.github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]
github	www.github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
github	www.github.com/hypequery/hypequery/pull/349
github	www.github.com/hypequery/hypequery/commit/2dc1df7bae
github	www.github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md
github	www.github.com/hypequery/hypequery/releases/tag/@hypequery/[email protected]

Parameter	Position	Path	Description	CWE
user-supplied parameter	nested	packages/clickhouse/src/core/utils.ts	Backslash escaping vulnerability in escapeValue() allowing SQL injection via trailing backslash in parameter values used in query construction.	CWE-89

04 Aug 2026 21:16Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.19.8

EPSS0.0044

SSVC

CWE-89