What is CVE-2026-54658?
CVE-2026-54658 is an SQL injection vulnerability in Hypequery, a TypeScript semantic layer for ClickHouse. In versions prior to 2.0.2, the 'escapeValue()' function in packages/clickhouse/src/core/utils.ts fails to escape backslashes before single quotes during parameter substitution, allowing attackers to manipulate queries. Users should upgrade to version 2.0.2 or later.
Azərbaycanca: CVE-2026-54658 Hypequery-in ClickHouse üçün TypeScript semantik qatında aşkarlanıb. 2.0.2 versiyasından əvvəl "escapeValue()" funksiyası parametr əvəzləməsi zamanı əks sləş simvolunu düzgün ekranlaşdırmadığı üçün SQL injection zəifliyinə səbəb olur. İstifadəçilər Hypequery-i 2.0.2 və ya daha yuxarı versiyaya yeniləməlidirlər.
Related CVEs
link basis: same weakness class CWE-89
FAQ2
Which versions of Hypequery are affected by CVE-2026-54658?
All versions of Hypequery prior to 2.0.2 are affected by this vulnerability.
What is the root cause of the CVE-2026-54658 SQL injection vulnerability?
The vulnerability is caused by the `escapeValue()` function failing to properly escape backslashes before single quotes during parameter substitution.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.