Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

Description

Kysely 0.28.12 added a sanitizeStringLiteral() call inside DefaultQueryCompiler.visitJSONPathLeg (commit 0a602bf, PR #1727) to fix CVE-2026-32763 (GHSA-wmrf-hv6w-mr66). The fix only doubles single quotes (' → ''); it does not escape JSON-path metacharacters (., [, ], *, **, ?).

Recommendation

Update the kysely package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.26.0, < 0.28.17
• Patched version(s): 0.28.17

References

• GHSA-pv5w-4p9q-p3v2
• CVE-2026-44635
• CWE-1284
• CWE-22
• CWE-89
• CWE-915
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A3
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. - CVE-2026-32763
• Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
• i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns - CVE-2026-41691
• i18next-locize-backend has URL Injection via Unsanitized Path Parameters - CVE-2026-41885

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How do hackers hack websites?

Update Cheat Sheet for Developers

Tags:

npm

kysely