Cloudanix VulnDB

CVE-2026-32763

High · 8.2

CVSS

8.2

EPSS

0.4%

Published

Mar 20, 2026

CISA due date

—

The record

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals (`'$.key'`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with `sanitizeIdentifier()`, which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Version 0.28.12 fixes the issue.

Affected packages

Ecosystem Package Introduced Fixed
npm kysely 0.26.0 0.28.12
Chainguard langfuse-2 0 2.95.12-r15
Chainguard langfuse-2-worker 0 2.95.12-r16
Chainguard langfuse-3 0 3.162.0-r1
Chainguard langfuse-3-worker 0 3.163.0-r0
Chainguard langfuse-fips-2 0 2.95.12-r18
Chainguard langfuse-fips-2-worker 0 2.95.12-r19
Chainguard langfuse-fips-3 0 3.162.0-r0
Chainguard langfuse-fips-3-worker 0 3.162.0-r1
Wolfi langfuse-3 0 3.162.0-r1
Wolfi langfuse-3-worker 0 3.163.0-r0

Related vulnerabilities