PT-2026-65646 · Npm · @Hypequery/Clickhouse

Published 2026-07-28 · Updated 2026-07-28

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact

A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote.

Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters.

Patches

The vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes

Workarounds

No workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-6WCC-39RP-HH9P

Affected Products

@Hypequery/Clickhouse

References · 6

• https://osv.dev/vulnerability/GHSA-6wcc-39rp-hh9p · Vendor Advisory
• https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202 · Note
• https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2 · Note
• https://github.com/hypequery/hypequery · Note
• https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf · Note
• https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p · Note