GHSA-pv5w-4p9q-p3v2
High · 7.5CVSS
7.5
EPSS
—
Published
May 11, 2026
CISA due date
—
The record
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | kysely | 0.26.0 | 0.28.17 |
Related vulnerabilities
- CVE-2026-44635 Kysely is a type-safe TypeScript SQL query builder. Same vulnerability
- CVE-2026-33468 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- CVE-2026-33442 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- GHSA-8cpq-38p9-67gx Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)`… Also affects kysely
- GHSA-fr9j-6mvq-frcv Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of… Also affects kysely
- CVE-2026-32763 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- GHSA-wmrf-hv6w-mr66 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors… Also affects kysely
- CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-1284