CVE-2026-54658

npm/@hypequery/clickhouse CVE-2026-54658: critical 9.8

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

Action: Upgrade @hypequery/clickhouse to 2.5.1 or later.

npm i @hypequery/clickhouse@2.5.1

Affected

Fixed versions

Sources

• osv: GHSA-6wcc-39rp-hh9p
• https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p
• https://nvd.nist.gov/vuln/detail/CVE-2026-54658
• https://github.com/hypequery/hypequery/pull/349
• https://github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff05510976960
• https://github.com/hypequery/hypequery/commit/2dc1df7bae
• https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf
• https://github.com/hypequery/hypequery
• https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202
• https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2
• https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.5.1

CVE-2026-54658 · published 2026-07-28T22:19:23Z · modified 2026-08-04T20:45:18.872507897Z · JSON