Description
Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key() and .at() directly into single-quoted JSON path string literals ('$.key') without escaping single quotes.
Recommendation
Update the kysely package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.26.0, <= 0.28.11
- Patched version(s): 0.28.12
References
Could your website be exposed too?
SmartScanner can check your website for SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
- Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` - CVE-2026-44635
- Orval has Code Injection via unsanitized x-enum-descriptions using JS comments - CVE-2026-25141
- i18next-locize-backend has URL Injection via Unsanitized Path Parameters - CVE-2026-41885
You might also like:
See something that needs correcting? Let us knowUpdated March 20, 2026