Description
The sanitizeStringLiteral method in Kysely’s query compiler escapes single quotes (' → '') but does not escape backslashes. On MySQL with the default BACKSLASH_ESCAPES SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL.
Recommendation
Update the kysely package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.28.12, <= 0.28.13
- Patched version(s): 0.28.14
References
Could your website be exposed too?
SmartScanner can check your website for Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that - CVE-2026-33468
- SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. - CVE-2026-32763
- Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` - CVE-2026-44635
- Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial - CVE-2026-33940
You might also like:
See something that needs correcting? Let us knowUpdated March 27, 2026