Skip to content
OpenAdvisories

Vendor

hypequery

1 known vulnerabilities.

Products

hypequery 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-54658

    @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

    Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a…

    hypequery hypequery @hypequery/clickhouse npm