CVE-2026-54658: Hypequery ClickHouse SQL Injection Flaw

CVE-2026-54658 Overview

CVE-2026-54658 is a SQL injection vulnerability [CWE-89] in Hypequery, a TypeScript semantic layer for ClickHouse. The flaw resides in the escapeValue() function in packages/clickhouse/src/core/utils.ts. Prior to version 2.0.2, the function fails to escape backslashes before single quotes during parameter substitution. Attackers can supply query parameters ending with a trailing backslash to escape the closing quote and inject arbitrary SQL statements. The vulnerability is network-exploitable without authentication or user interaction. Hypequery released version 2.0.2 to remediate the issue.

Critical Impact
Unauthenticated attackers can inject arbitrary SQL statements against the backing ClickHouse database, compromising query confidentiality, integrity, and availability.

Affected Products

@hypequery/clickhouse versions prior to 2.0.2
Applications using Hypequery TypeScript semantic layer with ClickHouse
Downstream services exposing Hypequery-generated query parameters to untrusted input

Discovery Timeline

2026-07-28 - CVE-2026-54658 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-54658

Vulnerability Analysis

Hypequery constructs ClickHouse SQL queries by substituting user-supplied parameters into query templates. The escapeValue() helper wraps string values in single quotes and doubles internal single quotes to prevent injection. The vulnerable implementation neglects to escape backslash characters, which ClickHouse and many SQL dialects treat as escape characters within quoted string literals.

A string value ending in a single backslash produces output such as 'value\', where the trailing backslash escapes the closing quote. Subsequent characters supplied by the attacker are then parsed as SQL rather than as string content. This allows arbitrary statement injection into any query built through the semantic layer.

Root Cause

The root cause is incomplete input neutralization in the string escape routine. The original code only replaced single quotes with doubled quotes and did not escape backslashes, violating ClickHouse string-literal quoting rules. Any parameter value under attacker control could break out of its enclosing quotes.

Attack Vector

An attacker submits a crafted parameter containing a trailing backslash followed by SQL syntax to any application endpoint that forwards user input into a Hypequery query. Because exploitation is network-based, requires no privileges, and needs no user interaction, any exposed API accepting string filters is a viable entry point.

typescript

// Security patch in packages/clickhouse/src/core/utils.ts
// fix(security): SQL injection vulnerability in parameter escaping
   else if (typeof value === 'number') {
     return value.toString();
   } else if (typeof value === 'string') {
-    return `'${value.replace(/'/g, "''")}'`;
+    const escaped = value.replace(/\\/g, '\\\\').replace(/'/g, "''");
+    return `'${escaped}'`;
   } else if (value instanceof Date) {
     return `'${value.toISOString()}'`;
   } else {
// Source: GitHub commit 4dfa9d77d70a08b970e722268b75ca7d13db0bdf

The patch prepends a backslash-escaping pass before the existing quote-escaping pass, ensuring a trailing backslash cannot terminate the string literal.

Detection Methods for CVE-2026-54658

Indicators of Compromise

ClickHouse query logs containing parameter values ending in \ immediately followed by SQL keywords such as UNION, SELECT, --, or ;
Application logs recording HTTP request parameters with unbalanced backslash characters or unusual quote sequences
Unexpected system.* table access or bulk data extraction queries originating from application service accounts
Deviations from the parameterized query shapes normally emitted by Hypequery

Detection Strategies

Enable ClickHouse query_log and alert on statements whose structure differs from application-generated templates
Deploy a web application firewall rule inspecting request parameters for trailing backslashes adjacent to SQL metacharacters
Perform dependency scanning of Node.js projects for @hypequery/clickhouse versions below 2.0.2

Monitoring Recommendations

Baseline normal query volume and shape per application user, alerting on outliers in row counts read or tables touched
Forward ClickHouse and application logs to a centralized analytics platform for correlation of injection patterns
Track authentication and access anomalies on the ClickHouse service account used by Hypequery

How to Mitigate CVE-2026-54658

Immediate Actions Required

Upgrade @hypequery/clickhouse to version 2.0.2 or later across all environments
Audit application code paths that pass untrusted input into Hypequery query builders
Review ClickHouse query logs for suspicious statements dating back to initial Hypequery deployment
Rotate credentials for any ClickHouse accounts used by exposed Hypequery applications

Patch Information

The fix is available in @hypequery/clickhouse@2.0.2. See the GitHub Security Advisory GHSA-6wcc-39rp-hh9p, the GitHub Changelog Entry, the GitHub Release Tag, and the GitHub Commit Details.

Workarounds

Reject or strip backslash characters from user-supplied string parameters before passing them to Hypequery
Constrain the ClickHouse service account used by the application to least-privilege read scopes on required tables only
Deploy an application-layer allowlist validating parameter format against expected patterns

bash

# Update to the patched version
npm install @hypequery/clickhouse@2.0.2

# Verify the installed version
npm ls @hypequery/clickhouse