Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that

Description

Kysely’s DefaultQueryCompiler.sanitizeStringLiteral() only escapes single quotes by doubling them (' → '') but does not escape backslashes.

Recommendation

Update the kysely package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.28.13
• Patched version(s): 0.28.14

References

• GHSA-8cpq-38p9-67gx
• CVE-2026-33468
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
• @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading - CVE-2026-41640
• Drizzle ORM has SQL injection via improperly escaped SQL identifiers - CVE-2026-39356
• Parse Server has a SQL injection via query field name when using PostgreSQL - CVE-2026-32234

You might also like:

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

Update Cheat Sheet for Developers

Tags:

npm

kysely