SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

Description

Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key() and .at() directly into single-quoted JSON path string literals ('$.key') without escaping single quotes.

Recommendation

Update the kysely package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.26.0, <= 0.28.11
• Patched version(s): 0.28.12

References

• GHSA-wmrf-hv6w-mr66
• CVE-2026-32763
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
• Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` - CVE-2026-44635
• Parse Server has a SQL injection via query field name when using PostgreSQL - CVE-2026-32234
• i18next-locize-backend has URL Injection via Unsanitized Path Parameters - CVE-2026-41885

You might also like:

How do hackers hack websites?

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Tags:

npm

kysely