CVE-2026-54658

Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL. This issue is fixed in version 2.0.2. Version 2.0.2 fixes string parameters, while version 2.5.1 fixes all known vectors. Upgrading to 2.5.1 or later is the only complete fix. In versions 2.0.2 through 2.5.0, serializing non-scalar parameters with  JSON.stringify()  before passing them is a workaround for the object/array vector only.

• CWE-89

• https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202
• https://github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff05510976960
• https://github.com/hypequery/hypequery/commit/2dc1df7bae
• https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
• https://github.com/hypequery/hypequery/pull/349
• https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2
• https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.5.1
• https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p

Published

Jul 28, 2026

Last Modified

Aug 4, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54651pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-54652Frigate is an open source network video recorder. In version…8.1
• CVE-2026-54653datamodel-code-generator generates Pydantic v2 models, datac…8.8
• CVE-2026-54654datamodel-code-generator generates Python data models from s…7.8
• CVE-2026-54655datamodel-code-generator generates Python data models from s…7.8
• CVE-2026-54656datamodel-code-generator generates Pydantic v2 models, datac…7.8
• CVE-2026-54659Pagy is agnostic pagination in plain Ruby. From 43.0.0 until…6.9
• CVE-2026-5466wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` deco…8.1
• CVE-2026-54660swagger-typescript-api generates API clients for Fetch or Ax…7.4
• CVE-2026-54661swagger-typescript-api generates API clients for Fetch or Ax…8.3
• CVE-2026-54662swagger-typescript-api generates API clients for Fetch or Ax…8.3
• CVE-2026-54663swagger-typescript-api generates API clients for Fetch or Ax…6.1