Security readout for executives and security teams
Plain-English summary
A flaw in Hypequery’s ClickHouse parameter handling can let unauthenticated attackers turn crafted application input into unintended database commands. Systems using @hypequery/clickhouse versions below 2.5.1 are affected when attacker-controlled values reach query parameters. Successful abuse could expose, alter, or disrupt ClickHouse data.
Executive priority
Treat as an urgent remediation for internet-facing or untrusted-input applications. Inventory immediately and prioritize upgrading exposed production services to 2.5.1 or later. Systems without attacker-controlled parameter paths remain affected by version but may have lower practical exposure pending confirmation.
Technical view
escapeValue() failed to escape backslashes before single quotes during parameter substitution. A crafted value could escape its quoted context and inject SQL. Version 2.0.2 corrected string parameters, but object and array vectors remained through 2.5.0. Version 2.5.1 addresses all known vectors.
Likely exposure
Exposure depends on application data flow, not merely package presence. Highest risk exists where remote, unauthenticated users can influence parameters passed through vulnerable @hypequery/clickhouse versions. Impact is governed by the permissions and accessible data of the application’s ClickHouse connection.
Exploitation context
The CVSS 3.1 score is 9.8, reflecting remote, low-complexity, unauthenticated exploitation without user interaction and potentially high confidentiality, integrity, and availability impact. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation.
Researcher notes
This is CWE-89 caused by incorrect string escaping during client-side parameter substitution. Researchers should distinguish the partial 2.0.2 string fix from the comprehensive 2.5.1 fix. The supplied evidence does not identify public exploitation, KEV inclusion, affected deployment counts, or a confirmed proof-of-concept campaign.
Mitigation direction
- Upgrade @hypequery/clickhouse to version 2.5.1 or later; this is the only complete fix identified.
- Rebuild and redeploy affected applications so production runtimes actually use the upgraded dependency.
- For versions 2.0.2–2.5.0, JSON.stringify non-scalar parameters as a temporary object and array workaround.
- Restrict untrusted input from reaching vulnerable query paths until the complete upgrade is deployed.
Validation and detection
- Inspect manifests, lockfiles, deployed artifacts, and runtime dependency trees for @hypequery/clickhouse versions below 2.5.1.
- Trace whether user-controlled values reach Hypequery ClickHouse parameter substitution.
- Confirm production instances resolve version 2.5.1 or later after deployment.
- Run benign regression tests covering strings, backslashes, quotes, objects, and arrays in a non-production environment.
- Review ClickHouse connection privileges and reduce unnecessary permissions to limit potential impact.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-54658 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9pCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/hypequery/hypequery/pull/349CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/hypequery/hypequery/commit/2879161a810fed2c2222f785816ff05510976960CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/hypequery/hypequery/commit/2dc1df7baeCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdfCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.5.1CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.