What is the CVSS score of CVE-2026-54658?

CVE-2026-54658 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-54658?

Yes, a public proof-of-concept exploit is available for CVE-2026-54658. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2026-54658?

Yes, a patch is available for CVE-2026-54658. Update the affected software to the latest version immediately.

CVE-2026-54658

EUVD-2026-50086 CRITICAL

SQL Injection (CWE-89)

2026-07-28 https://github.com/hypequery/hypequery

GHSA-6wcc-39rp-hh9p

SQLi

9.8

CVSS 3.1 · Vendor: https://github.com/hypequery/hypequery

Severity by source

Vendor (https://github.com/hypequery/hypequery) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (https://github.com/hypequery/hypequery) · only source for this CVE.

CVSS VectorVendor: https://github.com/hypequery/hypequery

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 28, 2026 - 22:50 vuln.today

Analysis Generated

Jul 28, 2026 - 22:50 vuln.today

CVE Published

Jul 28, 2026 - 22:19 github-advisory

CRITICAL 9.8

DescriptionCVE.org

Impact

A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote.

Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters.

Patches

The vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes

Workarounds

No workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.

AnalysisAI

SQL injection in @hypequery/clickhouse before version 2.0.2 allows unauthenticated remote attackers to inject arbitrary SQL commands through a trailing backslash in a query parameter. All users passing user-controlled input are affected, and the vulnerability can lead to full disclosure, modification, or destruction of the database. A vendor patch is available, and there is no evidence of active exploitation in the wild.