https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 29 Jul 2026 17:28:19 +0000 https://vulnerability.circl.lu/sighting/8df48e91-c11f-434a-a4e4-76fa0e76799c/export {"uuid": "8df48e91-c11f-434a-a4e4-76fa0e76799c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54658", "type": "seen", "source": "https://gist.github.com/alon710/58765246c17b37995ac42b87551c99f8", "content": "# CVE-2026-54658: CVE-2026-54658: SQL Injection via Parameter Escaping Bypass in @hypequery/clickhouse\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54658\n\n## Summary\nA critical SQL injection vulnerability was identified in @hypequery/clickhouse prior to version 2.0.2. The escapeValue utility function in packages/clickhouse/src/core/utils.ts fails to escape literal backslash characters before replacing single quotes. This allows remote, unauthenticated attackers to supply input parameters ending in a backslash, neutralizing the closing quote character inside ClickHouse databases and enabling arbitrary SQL execution.\n\n## TL;DR\nImproper escaping of trailing backslash characters in @hypequery/clickhouse parameter substitution allows attackers to escape string literal boundaries and inject arbitrary SQL commands into ClickHouse queries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity**: 9.8 (Critical)\n- **Exploit Status**: PoC (Proof of Concept) available in repository tests\n- **CISA KEV Status**: Not listed\n- **Mitigated Version**: 2.0.2\n\n## Affected Systems\n\n- @hypequery/clickhouse\n- **@hypequery/clickhouse**: < 2.0.2 (Fixed in: `2.0.2`)\n\n## Mitigation\n\n- Upgrade the dependency `@hypequery/clickhouse` to version 2.0.2 or higher immediately.\n- Apply least-privilege principles to database connections, restricting write, modify, and drop permissions for application service roles.\n- Deploy Web Application Firewall (WAF) signatures to block incoming HTTP requests with parameter values containing unescaped trailing backslashes.\n\n**Remediation Steps:**\n1. Open the project package.json file and locate the dependency entry for @hypequery/clickhouse.\n2. Update the version number to at least 2.0.2.\n3. Run your package manager install command (e.g., npm install or yarn install) to pull down and link the patched library version.\n4. Verify the changes by checking package-lock.json or yarn.lock to confirm the installed package is 2.0.2.\n\n## References\n\n- [CVE Official Record](https://www.cve.org/CVERecord?id=CVE-2026-54658)\n- [GitHub Security Advisory GHSA-6wcc-39rp-hh9p](https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p)\n- [Official Security Patch Commit](https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf)\n- [Release Changelog](https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202)\n- [Release Page](https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54658) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T04:31:03.894417Z"} {"uuid": "8df48e91-c11f-434a-a4e4-76fa0e76799c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54658", "type": "seen", "source": "https://gist.github.com/alon710/58765246c17b37995ac42b87551c99f8", "content": "# CVE-2026-54658: CVE-2026-54658: SQL Injection via Parameter Escaping Bypass in @hypequery/clickhouse\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54658\n\n## Summary\nA critical SQL injection vulnerability was identified in @hypequery/clickhouse prior to version 2.0.2. The escapeValue utility function in packages/clickhouse/src/core/utils.ts fails to escape literal backslash characters before replacing single quotes. This allows remote, unauthenticated attackers to supply input parameters ending in a backslash, neutralizing the closing quote character inside ClickHouse databases and enabling arbitrary SQL execution.\n\n## TL;DR\nImproper escaping of trailing backslash characters in @hypequery/clickhouse parameter substitution allows attackers to escape string literal boundaries and inject arbitrary SQL commands into ClickHouse queries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity**: 9.8 (Critical)\n- **Exploit Status**: PoC (Proof of Concept) available in repository tests\n- **CISA KEV Status**: Not listed\n- **Mitigated Version**: 2.0.2\n\n## Affected Systems\n\n- @hypequery/clickhouse\n- **@hypequery/clickhouse**: < 2.0.2 (Fixed in: `2.0.2`)\n\n## Mitigation\n\n- Upgrade the dependency `@hypequery/clickhouse` to version 2.0.2 or higher immediately.\n- Apply least-privilege principles to database connections, restricting write, modify, and drop permissions for application service roles.\n- Deploy Web Application Firewall (WAF) signatures to block incoming HTTP requests with parameter values containing unescaped trailing backslashes.\n\n**Remediation Steps:**\n1. Open the project package.json file and locate the dependency entry for @hypequery/clickhouse.\n2. Update the version number to at least 2.0.2.\n3. Run your package manager install command (e.g., npm install or yarn install) to pull down and link the patched library version.\n4. Verify the changes by checking package-lock.json or yarn.lock to confirm the installed package is 2.0.2.\n\n## References\n\n- [CVE Official Record](https://www.cve.org/CVERecord?id=CVE-2026-54658)\n- [GitHub Security Advisory GHSA-6wcc-39rp-hh9p](https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p)\n- [Official Security Patch Commit](https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf)\n- [Release Changelog](https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202)\n- [Release Page](https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54658) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T04:31:03.894417Z"} https://vulnerability.circl.lu/sighting/8df48e91-c11f-434a-a4e4-76fa0e76799c/export Wed, 29 Jul 2026 04:31:03 +0000 https://vulnerability.circl.lu/sighting/32e7ef6b-aaf0-4d4b-8a8a-da97bbad560a/export {"uuid": "32e7ef6b-aaf0-4d4b-8a8a-da97bbad560a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54658", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqwtmubyr2o", "content": "CVE-2026-54658 - @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution\nCVE ID : CVE-2026-54658\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 21\u00a0minutes ago\n \n Description : Hypequery is a TypeScript semantic layer for ClickHous...", "creation_timestamp": "2026-07-29T03:03:30.193749Z"} {"uuid": "32e7ef6b-aaf0-4d4b-8a8a-da97bbad560a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54658", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqwtmubyr2o", "content": "CVE-2026-54658 - @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution\nCVE ID : CVE-2026-54658\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 21\u00a0minutes ago\n \n Description : Hypequery is a TypeScript semantic layer for ClickHous...", "creation_timestamp": "2026-07-29T03:03:30.193749Z"} https://vulnerability.circl.lu/sighting/32e7ef6b-aaf0-4d4b-8a8a-da97bbad560a/export Wed, 29 Jul 2026 03:03:30 +0000 https://vulnerability.circl.lu/sighting/8d982bd1-1d72-436e-8440-ac929b1b8d8f/export {"uuid": "8d982bd1-1d72-436e-8440-ac929b1b8d8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54658", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqw4vq6xv2s", "content": "CVE-2026-54658 - @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution\nCVE ID : CVE-2026-54658\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 23\u00a0minutes ago\n \n Description : Hypequery is a TypeScript semantic layer for ClickHous...", "creation_timestamp": "2026-07-29T02:50:47.600723Z"} {"uuid": "8d982bd1-1d72-436e-8440-ac929b1b8d8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54658", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqw4vq6xv2s", "content": "CVE-2026-54658 - @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution\nCVE ID : CVE-2026-54658\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 23\u00a0minutes ago\n \n Description : Hypequery is a TypeScript semantic layer for ClickHous...", "creation_timestamp": "2026-07-29T02:50:47.600723Z"} https://vulnerability.circl.lu/sighting/8d982bd1-1d72-436e-8440-ac929b1b8d8f/export Wed, 29 Jul 2026 02:50:47 +0000 https://vulnerability.circl.lu/sighting/aadebc2a-1fd4-4e59-aa54-012bdeeed816/export {"uuid": "aadebc2a-1fd4-4e59-aa54-012bdeeed816", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54658", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqtdtaeoa2u", "content": "\ud83d\udd34 CVE-2026-54658 - Critical (9.8)\n\nHypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in package...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54658/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T02:00:59.872209Z"} {"uuid": "aadebc2a-1fd4-4e59-aa54-012bdeeed816", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54658", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqtdtaeoa2u", "content": "\ud83d\udd34 CVE-2026-54658 - Critical (9.8)\n\nHypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in package...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54658/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T02:00:59.872209Z"} https://vulnerability.circl.lu/sighting/aadebc2a-1fd4-4e59-aa54-012bdeeed816/export Wed, 29 Jul 2026 02:00:59 +0000 https://vulnerability.circl.lu/sighting/f621859d-c35b-4117-9d3a-2d152ee92d99/export {"uuid": "f621859d-c35b-4117-9d3a-2d152ee92d99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54658", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrqmavaytp2e", "content": "CVE-2026-54658 - hypequery\nClickhouse users with outdated versions (before 2.0.2) are at risk if they pass user-controlled input as query parameters. This could allow attackers to execute arbitrary SQL\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#hypequery #npm #CVE #infosec", "creation_timestamp": "2026-07-28T23:54:04.112842Z"} {"uuid": "f621859d-c35b-4117-9d3a-2d152ee92d99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54658", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrqmavaytp2e", "content": "CVE-2026-54658 - hypequery\nClickhouse users with outdated versions (before 2.0.2) are at risk if they pass user-controlled input as query parameters. This could allow attackers to execute arbitrary SQL\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#hypequery #npm #CVE #infosec", "creation_timestamp": "2026-07-28T23:54:04.112842Z"} https://vulnerability.circl.lu/sighting/f621859d-c35b-4117-9d3a-2d152ee92d99/export Tue, 28 Jul 2026 23:54:04 +0000