Critical SQL Injection in @hypequery/clickhouse

A critical SQL injection vulnerability, tracked as CVE-2026-54658, has been identified in the @hypequery/clickhouse npm package. This flaw allows unauthorized users to inject and execute arbitrary SQL commands by manipulating query parameters, posing a significant risk to data integrity and system security.

What's at Risk

The vulnerability affects all versions of @hypequery/clickhouse prior to 2.0.2. Organizations utilizing this library to handle database interactions are at risk if their applications pass user-controlled input directly into query parameters.

Systems that expose database interfaces to external users are particularly susceptible, as the flaw resides in the way the library handles parameter substitution. Any environment where untrusted data is processed through these functions could potentially allow an attacker to bypass intended security controls.

How the Flaw Works

SQL injection occurs when an application fails to properly sanitize or parameterize input before including it in a database query. In this specific case, the escapeValue() function fails to account for backslashes used to escape closing quotes, allowing an attacker to break out of the intended string context.

Generally, this type of vulnerability enables an attacker to manipulate the structure of the underlying SQL statement. By altering the query logic, unauthorized parties can often read sensitive data from the database, modify existing records, or in some cases, execute administrative commands that compromise the entire database server.

How to Protect Your Systems

• Update the @hypequery/clickhouse package to version 2.0.2 or later immediately to incorporate the necessary security fix.
• Avoid attempting manual input validation or custom sanitization, as the library must handle the escaping logic internally to be effective.
• Conduct a review of codebase implementations to identify where user-controlled input is passed to database queries.
• Monitor database logs for unusual or unexpected query patterns that may indicate attempts to exploit SQL injection vulnerabilities.
• Implement the principle of least privilege for database accounts to limit the potential impact if an injection vulnerability is successfully triggered.

Given the critical CVSS score of 9.8, prompt action is necessary to secure affected environments. Because no workaround exists outside of the official patch, upgrading to version 2.0.2 is the only reliable way to mitigate the risk of arbitrary SQL execution.