CVE-2026-54658 in Hypequery

Riassunto

di MITRE • 29/07/2026

Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL. This issue is fixed in version 2.0.2.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsabile: GitHub M
• Prenotare: 15/06/2026
• Divulgazione: 29/07/2026
• Moderazione: accettato
• Voce: VDB-384038
• CPE: pronto
• CWE: CWE-74 (confermato)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Attività: basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-54658
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54658
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-54658/