CVE-2026-54658Critical· 9.8▾ Midnight@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
0.4% → 0.8%
A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote.
Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters.
The vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes
No workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.
@hypequery/clickhouse < 2.0.2Upgrade to a patched release:
@hypequery/clickhouse 2.0.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-10079High· 7.3A flaw has been found in PHPGurukul Small CRM 4.0
CVE-2025-10405High· 7.3A vulnerability was determined in itsourcecode Baptism Information Management System 1.0
CVE-2025-10479High· 7.3A security flaw has been discovered in SourceCodester Online Student File Management System 1.0
CVE-2025-10387Medium· 6.3A vulnerability was determined in codesiddhant Jasmin Ransomware up to 1.0.1
CVE-2025-10068High· 7.3A flaw has been found in itsourcecode Online Discussion Forum 1.0
CVE-2025-10601High· 7.3A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0