An SQL injection issue affects rsyslog deployments using the optional omclickhouse output module. Its built-in INSERT template used escaping that did not account for ClickHouse backslash escapes. A sender able to submit a log message routed to this action could alter the SQL sent to ClickHouse, potentially forging stored log records or evaluating expressions with the configured ClickHouse accounts privileges.