AIKIDO-2026-117200

TL;DR

The ClickHouse vector database backend builds a SQL DELETE WHERE clause in delete_by_metadata by interpolating metadata keys and values directly into the query string with f-strings. Code that routes untrusted metadata into this method lets those values be parsed as SQL rather than as data. This enables injection that can delete all rows, target specific records, or extract data through error-based or blind techniques. The fix binds each metadata key and value as a ClickHouse named parameter so the driver escapes them instead of interpolating raw strings.