Approved changes feed: RSS · Atom
cpe:2.3:a:hypequery:hypequery:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Hypequery (94eb3a6f-a604-5c84-bc28-104f244c473e) |
|---|---|
| Product | Hypequery (17925d8a-4156-53b5-b831-8d1c81cf8b11) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54658 |
vulnerable | 2026-09-16 04:33:28.365130 |
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
CRITICAL (9.8)
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL. This issue is fixed in version 2.0.2. Version 2.0.2 fixes string parameters, while version 2.5.1 fixes all known vectors. Upgrading to 2.5.1 or later is the only complete fix. In versions 2.0.2 through 2.5.0, serializing non-scalar parameters with JSON.stringify() before passing them is a workaround for the object/array vector only.
Published: 2026-07-28T22:18:48.800Z
Updated: 2026-08-04T20:39:44.798Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.