PT-2026-65620 · Hypequery · Hypequery

CVE-2026-54658 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hypequery versions prior to 2.0.2

Description A SQL injection issue exists in the escapeValue() function within the packages/clickhouse/src/core/utils.ts file. The function fails to escape backslashes before single quotes during parameter substitution. This allows an attacker to provide query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL commands.

Recommendations Update to version 2.0.2.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-54658

GHSA-6WCC-39RP-HH9P

Affected Products

Hypequery

References · 7

• https://osv.dev/vulnerability/GHSA-6wcc-39rp-hh9p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54658 · Security Note
• https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2 · Note
• https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p · Note
• https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf · Note
• https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202 · Note
• https://github.com/hypequery/hypequery · Note