CVE-2026-54658 with a CVSS score of 9.8 is a SQL injection vulnerability in the parameter escaping function used for query parameter substitution, allowing attackers to inject arbitrary SQL by using a trailing backslash to escape the closing quote. All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters are impacted. The vulnerability can be exploited via the library's custom icon rendering component, which is used for rating block functionality, and requires no user interaction or privileges. This allows attackers to execute arbitrary SQL queries, resulting in a high business impact, including unauthorized data access and modification, potentially leading to data breaches.
We recommend you to update @hypequery/clickhouse to version 2.0.2 or 2.0.2.[/subscribe_to_unlock_form]
CVE-2026-54658 with a CVSS score of 9.8 is a SQL injection vulnerability in the parameter escaping function used for query parameter substitution, allowing attackers to inject arbitrary SQL by using a trailing backslash to escape the closing quote. All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters are impacted. The vulnerability can be exploited via the library's custom icon rendering component, which is used for rating block functionality, and requires no user interaction or privileges. This allows attackers to execute arbitrary SQL queries, resulting in a high business impact, including unauthorized data access and modification, potentially leading to data breaches.
We recommend you to update @hypequery/clickhouse to version 2.0.2 or 2.0.2.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]