SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

Description

Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key() and .at() directly into single-quoted JSON path string literals ('$.key') without escaping single quotes.

Recommendation

Update the kysely package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.26.0, <= 0.28.11
• Patched version(s): 0.28.12

References

• GHSA-wmrf-hv6w-mr66
• CVE-2026-32763
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
• Parse Server has a SQL injection via query field name when using PostgreSQL - CVE-2026-32234
• Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that - CVE-2026-33468
• Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path - CVE-2026-26280

Tags:

npm

kysely