VulnSocial

CVE-2026-54658Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL. This issue is fixed in version 2.0.2. Version 2.0.2 fixes string parameters, while version 2.5.1 fixes all known vectors. Upgrading to 2.5.1 or later is the only complete fix. In versions 2.0.2 through 2.5.0, serializing non-scalar parameters with  JSON.stringify()  before passing them is a workaround for the object/array vector only.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 3 mentions (2026-07-29); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-07-29: 3Mentions · 2026-07-30: 1PoC Mentioned / Linked · 2026-07-29: 1Patch / Workaround · 2026-07-29: 1Technical Details · 2026-07-29: 3Technical Details · 2026-07-30: 107-2907-30
Signal classification2 categories
Disclosure
375.0%
General
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-293
Disclosure3
2026-07-301
General1
Full discourse4 posts
  • Israel@f1tym1
    General

    CVE-2026-54658: SQL injection via parameter escaping bypass in hypequery/clickhouse https://ift.tt/7lFxh1S

    Post summary

    The post announces CVE-2026-54658 as an SQL injection via parameter escaping bypass in hypequery/clickhouse, but lacks additional technical, exploitation, or mitigation details.

    0000068
    1.0K followersView on X
  • Israel@f1tym1
    Disclosure

    CVE-2026-54658: SQL injection via parameter escaping bypass in hypequery/clickhouse https://ift.tt/7lFxh1S

    Post summary

    A new SQL injection vulnerability (CVE‑2026‑54658) has been disclosed in hypequery/clickhouse, accompanied by a link to further details.

    0000067
    1.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-54658 Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before sing… https://www.cve.org/CVERecord?id=CVE-2026-54658 ----- Traducción: CVE-2026-54658 Hyp… http://infoflow.cloud`

    Post summary

    CVE-2026-54658 exposes an unescaped backslash bug in Hypequery’s escapeValue function, potentially leading to injection vulnerabilities; the record is newly disclosed to the public via the CVE website.

    0000057
    96 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-54658 Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before sing… https://www.cve.org/CVERecord?id=CVE-2026-54658

    Post summary

    The post reports that Hypequery’s ClickHouse driver had a back‑slash escaping bug prior to version 2.0.2, which is now addressed in that release, and links to the official CVE record.

    00000719
    57.9K followersView on X

Explore more

Back to dashboard