Description
Kysely’s DefaultQueryCompiler.sanitizeStringLiteral() only escapes single quotes by doubling them (' → '') but does not escape backslashes.
Recommendation
Update the kysely package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.28.13
- Patched version(s): 0.28.14
References
Could your website be exposed too?
SmartScanner can check your website for Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
- @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading - CVE-2026-41640
- @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution - CVE-2026-54658
- Payload has an SQL Injection via Query Handling - CVE-2026-34747
You might also like:
See something that needs correcting? Let us knowUpdated March 27, 2026