{"action":"Upgrade @hypequery/clickhouse to 2.5.1 or later.","affected":[{"fixed":"2.5.1","introduced":"0"}],"component":"@hypequery/clickhouse","cve_ids":["CVE-2026-54658"],"ecosystem":"npm","epss":0.00816,"exploited":false,"fixed_versions":["2.5.1"],"ghsa_id":"GHSA-6wcc-39rp-hh9p","id":"tcs_01M5KF856T2R3WJGS1J7KEVNDQ","modified_at":"2026-08-04T20:45:18.872507897Z","published_at":"2026-07-28T22:19:23Z","references":["https://osv.dev/vulnerability/GHSA-6wcc-39rp-hh9p","https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p","https://nvd.nist.gov/vuln/detail/CVE-2026-54658","https://github.com/hypequery/hypequery/pull/349","https://github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff05510976960","https://github.com/hypequery/hypequery/commit/2dc1df7bae","https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf","https://github.com/hypequery/hypequery","https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202","https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2","https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.5.1"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-6wcc-39rp-hh9p","url":"https://osv.dev/vulnerability/GHSA-6wcc-39rp-hh9p"}],"summary":"@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution"}