CVE-2026-44635

The record

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (., [, ], *, **, ?). When attacker-controlled input flows into eb.ref(col, '->$').key(input) or .at(input) — including type-safe code where the JSON column is shaped like Record<string, T> so K extends string is the inferred type — every dot becomes a path-leg separator, letting an attacker traverse from the intended key into sibling and child fields the developer never meant to expose. The result is read access (and, in update statements, write access) to JSON sub-fields outside the intended scope across MySQL, PostgreSQL ->$/->>$, and SQLite. This vulnerability is fixed in 0.28.17.

Affected packages

Related vulnerabilities

• GHSA-pv5w-4p9q-p3v2 Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in… Same vulnerability
• CVE-2026-33468 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
• CVE-2026-33442 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
• GHSA-8cpq-38p9-67gx Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)`… Also affects kysely
• GHSA-fr9j-6mvq-frcv Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of… Also affects kysely
• CVE-2026-32763 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
• GHSA-wmrf-hv6w-mr66 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors… Also affects kysely
• CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22