CVE-2026-33442

The record

Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely's query compiler escapes single quotes (`'` → `''`) but does not escape backslashes. On MySQL with the default `BACKSLASH_ESCAPES` SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL. Version 0.28.14 fixes the issue.

Affected packages

Related vulnerabilities

• GHSA-fr9j-6mvq-frcv Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of… Same vulnerability
• CVE-2026-44635 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
• GHSA-pv5w-4p9q-p3v2 Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in… Also affects kysely
• CVE-2026-33468 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
• GHSA-8cpq-38p9-67gx Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)`… Also affects kysely
• CVE-2026-32763 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
• GHSA-wmrf-hv6w-mr66 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors… Also affects kysely
• CVE-2026-87936 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89