PT-2026-65646 · Npm · @Hypequery/Clickhouse

Publicado 2026-07-28 · Atualizado 2026-07-28

OSV

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact

A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote.

Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters.

Patches

The vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes

Workarounds

No workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

GHSA-6WCC-39RP-HH9P

Produtos afetados

@Hypequery/Clickhouse

Referências · 6

• https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202 · Nota
• https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2 · Nota
• https://github.com/hypequery/hypequery · Nota
• https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf · Nota
• https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p · Nota
• https://osv.dev/vulnerability/GHSA-6wcc-39rp-hh9p · Aviso do Fabricante