CVE-2026-33468
High · 8.1CVSS
8.1
EPSS
0.4%
Published
Mar 26, 2026
CISA due date
—
The record
Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`. Version 0.28.14 contains a fix.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | kysely | 0 | 0.28.14 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r15 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r16 |
| Chainguard | langfuse-3 | 0 | 3.162.0-r1 |
| Chainguard | langfuse-3-worker | 0 | 3.163.0-r0 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r18 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r19 |
| Chainguard | langfuse-fips-3 | 0 | 3.162.0-r0 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.162.0-r1 |
| Wolfi | langfuse-3 | 0 | 3.162.0-r1 |
| Wolfi | langfuse-3-worker | 0 | 3.163.0-r0 |
Related vulnerabilities
- GHSA-8cpq-38p9-67gx Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)`… Same vulnerability
- CVE-2026-44635 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- GHSA-pv5w-4p9q-p3v2 Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in… Also affects kysely
- CVE-2026-33442 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- GHSA-fr9j-6mvq-frcv Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of… Also affects kysely
- CVE-2026-32763 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- GHSA-wmrf-hv6w-mr66 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors… Also affects kysely
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects langfuse-2