@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. escapeValue() dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal and have the rest of the value parsed as SQL. Vector 1 - string parameters. Fixed in 2.0.2. The string branch escaped ' as '' …