CVE-2026-54658: 
JavaScript vulnerability analysis and mitigation

CVE-2026-54658 is a critical SQL injection vulnerability in @hypequery/clickhouse, a TypeScript semantic layer for ClickHouse. The flaw exists in the escapeValue() function within packages/clickhouse/src/core/utils.ts, where backslashes were not escaped before single quotes during parameter substitution, allowing attacker-controlled query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL. All versions of @hypequery/clickhouse prior to 2.0.2 are affected. The vulnerability was originally published on June 8, 2026, and added to the GitHub Advisory Database on July 28, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerable escapeValue() function in src/core/utils.ts only escaped single quotes (replacing ' with '') but did not first escape backslashes. Because ClickHouse recognizes both SQL-standard ('') and C-style (\) escape sequences, a user-supplied string ending with a backslash (e.g., \) would escape the closing single quote, breaking out of the string literal and allowing the next parameter or appended text to be interpreted as raw SQL. The fix, introduced in commit 4dfa9d7, adds .replace(/\/g, '\\') before the single-quote replacement, ensuring backslashes are doubled before quoting (Github Advisory, Patch Commit). No privileges or user interaction are required; the attacker only needs the ability to control a query parameter value passed to the library.

Successful exploitation allows an unauthenticated remote attacker to inject and execute arbitrary SQL commands against the underlying ClickHouse database. This can result in full confidentiality loss (reading sensitive data), integrity loss (modifying or deleting database records), and availability impact (dropping tables or disrupting database operations). Depending on the ClickHouse configuration and the permissions of the database user, attackers may also be able to execute administrative operations or leverage ClickHouse's file-read capabilities for further lateral movement (Github Advisory).

1. Identify target: Locate a web application or API that uses @hypequery/clickhouse versions prior to 2.0.2 and passes user-controlled input as query parameters to the library.
2. Craft trailing backslash payload: Supply a parameter value ending with a single backslash (e.g., \) as the first parameter. In the unpatched escapeValue(), this becomes '\', where the backslash escapes the closing single quote, leaving the string boundary open.
3. Inject SQL in subsequent parameter: Supply the malicious SQL payload as the next parameter (e.g., OR 1=1 --). Because the first parameter's closing quote was escaped, the second parameter is rendered outside of a string literal and executed as raw SQL.
4. Example: For a query SELECT * FROM users WHERE name = ? AND status = ? with parameters ['\', ' OR 1=1 --'], the unpatched library produces: SELECT * FROM users WHERE name = '\' AND status = ' OR 1=1 --' — where \' escapes the quote, causing OR 1=1 -- to execute as SQL logic.
5. Escalate: Use the SQL injection to enumerate tables, exfiltrate data, modify records, or execute ClickHouse administrative functions depending on database user permissions (Github Advisory, Patch Commit).

• Network: Unusual or malformed query parameter values containing trailing backslashes (\) in HTTP requests to application endpoints that interact with ClickHouse via hypequery.
• Logs: ClickHouse query logs showing unexpected SQL syntax such as OR 1=1, DROP TABLE, INSERT, or SELECT statements appearing outside of string literals in parameterized queries; ClickHouse error logs indicating SQL parse errors from malformed injected queries.
• Application Logs: Application-level logs showing parameter values with trailing backslashes or SQL keywords in fields expected to contain plain user data.
• Database: Unexpected changes to ClickHouse table contents, new or dropped tables, or unusual administrative queries executed under the application's database user account.

Upgrade @hypequery/clickhouse to version 2.0.2 or later immediately. The fix properly escapes backslashes before single quotes in the escapeValue() function, neutralizing the injection vector. No configuration-based workaround exists — the advisory explicitly states that manual input validation or sanitization is not a recommended mitigation, as the library itself must handle escaping correctly. All users passing user-controlled input as query parameters to any version prior to 2.0.2 are affected and should treat this as an urgent upgrade (Github Advisory, Release Notes).

The vulnerability was responsibly disclosed by Coby Geralnik (@astelia/@cobyge) and credited in the official release notes and advisory. The maintainer published the fix promptly as a patch release. No significant broader media coverage or notable researcher commentary beyond the official advisory and standard vulnerability tracking feeds has been identified at this time (Github Advisory, Release Notes).