@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

NVD Description

### Impact A SQL injection vulnerability exists in the `escapeValue()` function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote. Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters. ### Patches The vulnerability has been patched in version 2.0.2. The fix properly escapes backslashes before escaping single quotes ### Workarounds No workaround exists other than upgrading. Manual input validation/sanitization is not recommended as a mitigation - the library must handle escaping correctly.

Affected Packages (1)