GHSA-wmrf-hv6w-mr66
High · 8.2CVSS
8.2
EPSS
—
Published
Mar 18, 2026
CISA due date
—
The record
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | kysely | 0.26.0 | 0.28.12 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r15 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r16 |
| Chainguard | langfuse-3 | 0 | 3.162.0-r1 |
| Chainguard | langfuse-3-worker | 0 | 3.163.0-r0 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r18 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r19 |
| Chainguard | langfuse-fips-3 | 0 | 3.162.0-r0 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.162.0-r1 |
| Wolfi | langfuse-3 | 0 | 3.162.0-r1 |
| Wolfi | langfuse-3-worker | 0 | 3.163.0-r0 |
Related vulnerabilities
- CVE-2026-32763 Kysely is a type-safe TypeScript SQL query builder. Same vulnerability
- CVE-2026-44635 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- GHSA-pv5w-4p9q-p3v2 Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in… Also affects kysely
- CVE-2026-33468 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- CVE-2026-33442 Kysely is a type-safe TypeScript SQL query builder. Also affects kysely
- GHSA-8cpq-38p9-67gx Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)`… Also affects kysely
- GHSA-fr9j-6mvq-frcv Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of… Also affects kysely
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects langfuse-2