GHSA-fr9j-6mvq-frcv
High · 8.1CVSS
8.1
EPSS
—
Published
Mar 20, 2026
CISA due date
—
The record
Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | kysely | 0.28.12 | 0.28.14 |
Related vulnerabilities
- CVE-2026-33442 Kysely is a type-safe TypeScript SQL query builder. Same vulnerability
- CVE-2026-44635 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- GHSA-pv5w-4p9q-p3v2 Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in… Also affects kysely
- CVE-2026-33468 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- GHSA-8cpq-38p9-67gx Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)`… Also affects kysely
- CVE-2026-32763 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- GHSA-wmrf-hv6w-mr66 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors… Also affects kysely
- CVE-2026-87936 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… CWE-89