A critical SQL injection vulnerability (CVE-2026-54658) exists in the @hypequery/clickhouse library's escapeValue() function. The vulnerability arises because the function fails to properly escape backslashes before escaping single quotes, enabling attackers who control query parameters to inject arbitrary SQL code by using a trailing backslash to escape the closing quote. This affects all versions prior to 2.0.2. The vendor fixed the issue in version 2.0.2 by correcting the escaping logic. No alternative mitigations are advised, making upgrading the only effective remediation.

Successful exploitation allows an unauthenticated attacker who can supply parameter values to execute arbitrary SQL commands on the backend database. This can lead to full compromise of data confidentiality, integrity, and availability within the affected system. The vulnerability is critical due to its ease of exploitation (network attack vector, no privileges or user interaction required) and the high impact on confidentiality, integrity, and availability.

Upgrade to @hypequery/clickhouse version 2.0.2 or later, where the vulnerability is fixed by properly escaping backslashes before single quotes in the escapeValue() function. No other workarounds or manual input sanitization are recommended or effective.