GHSA-6WCC-39RP-HH9P @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

A SQL injection vulnerability exists in the escapeValue function used for parameter substitution. escapeValue dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal an...

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

A SQL injection vulnerability exists in the escapeValue function used for parameter substitution. escapeValue dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal an...

@hypequery/cli (>=0.0.0-canary-20260728203235, <=0.0.0-canary-20260730070608) potentially affected by CVE-2026-54658 via @hypequery/clickhouse (>=0.0.0-canary-20260728203235, <=0.0.0-canary-20260730070608)

@hypequery/clickhouse NPM version =0.0.0-canary-20260728203235, =0.0.0-canary-20260728203235, =0.0.0-canary-20260730070608 Source cves: CVE-2026-54658 Source advisory: MEND:CVE-2026-54658...