Threats tagged 'ghsa-6wcc-39rp-hh9p'

@hypequery/clickhouse versions prior to 2.0.2 contain a SQL injection vulnerability in the escapeValue() function used for parameter substitution. This flaw allows attackers controlling parameter values to inject arbitrary SQL by exploiting improper escaping of trailing backslashes before closing quotes. The issue is fixed in version 2.0.2, which correctly escapes backslashes before single quotes. No workaround other than upgrading is recommended.