Skip to content
Threat Feed
Subscribe

Vendor

Hypequery

1 brief RSS
critical advisory

SQL Injection Vulnerability in @hypequery/clickhouse Allows Arbitrary SQL Execution

A SQL injection vulnerability exists in the `escapeValue()` function of the `@hypequery/clickhouse` library, affecting versions prior to 2.0.2, allowing attackers to leverage a trailing backslash in user-controlled query parameters to bypass escaping mechanisms, leading to arbitrary SQL execution against ClickHouse databases.

@hypequery/clickhouse sql-injection vulnerability npm clickhouse supply-chain
2t