Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that

Description

Kysely’s DefaultQueryCompiler.sanitizeStringLiteral() only escapes single quotes by doubling them (' → '') but does not escape backslashes.

Recommendation

Update the kysely package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.28.13
• Patched version(s): 0.28.14

References

• GHSA-8cpq-38p9-67gx
• CVE-2026-33468
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
• Parse Server has a SQL injection via query field name when using PostgreSQL - CVE-2026-32234
• SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. - CVE-2026-32763
• Parse Server has a NoSQL injection via token type in password reset and email verification endpoints - CVE-2026-30941

Tags:

npm

kysely