Prior to version 2.5.1, the escapeValue() function in Hypequery’s ClickHouse module failed to escape backslashes that immediately precede single quotes when performing parameter substitution. An attacker who can supply a query parameter that ends with a backslash can escape the closing quote and inject arbitrary SQL into the ClickHouse query. This allows the execution of read, update, delete, or other data‑manipulation operations on the ClickHouse database, compromising the confidentiality, integrity, and availability of the stored data. The vulnerability is a classic SQL injection flaw, identified as CWE‑89, and is scored with a CVSS of 9.8.

The vulnerability affects the @hypequery/clickhouse package, published by hypequery. All releases before 2.0.2 are vulnerable. Version 2.0.2 partially mitigates string‑parameter injections but still allows non‑scalar parameters to be exploited. Deployments using versions 2.0.2 through 2.5.0 should apply the JSON.stringify() workaround for non‑scalar parameters. The complete fix is incorporated in version 2.5.1 and later. Users on vulnerable versions should verify the installed package and plan an upgrade accordingly.

The CVSS score remains high at 9.8. Although the EPSS score is below 1% and the vulnerability is not listed in KEV, the risk to systems still running before 2.5.1 is significant. Attackers would need to supply malicious parameters to the ClickHouse query layer, which can be achieved from any component that accepts user input. Upgrading to 2.5.1 or later eliminates the flaw; until then, the partial patch in 2.0.2 and the JSON.stringify() workaround only protect against string parameter injection, leaving non‑scalar vectors exposed.