GHSA-6wcc-39rp-hh9p
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Quick fix
GHSA-6wcc-39rp-hh9p — @hypequery/clickhouse: upgrade to the fixed version with the command below.
npm install @hypequery/clickhouse@2.0.2Details
### Impact A SQL injection vulnerability exists in the `escapeValue()` function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote.
Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters.
### Patches The vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes
### Workarounds No workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.
Are you affected?
Enter the version of the package you're using.
Affected packages
0 Fixed in: 2.0.2 npm install @hypequery/clickhouse@2.0.2 References
- https://github.com/hypequery/hypequery/security/advisories/GHSA-6wcc-39rp-hh9p [WEB]
- https://github.com/hypequery/hypequery/commit/4dfa9d77d70a08b970e722268b75ca7d13db0bdf [WEB]
- https://github.com/hypequery/hypequery [PACKAGE]
- https://github.com/hypequery/hypequery/blob/main/packages/clickhouse/CHANGELOG.md#202 [WEB]
- https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2 [WEB]