TI-2026-25254 Aliases CVE-2026-32763 GHSA-wmrf-hv6w-mr66

SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

HIGH 75CWE-89Published 2026-03-19 · Updated 2026-03-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals (`'$.key'`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with `sanitizeIdentifier()`, which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Version 0.28.12 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00436 38th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed kysely (kysely-org): 0.28.12kysely (npm): 0.28.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kysely-org	kysely	0.26.0 to before 0.28.12	0.28.12	Patch available	CNA
—	kysely (npm)	0.26.0 to before 0.28.12	0.28.12	Patch available	GHSA-wmrf-hv6w-mr66

kysely Vendorkysely-org Affected 0.26.0 to before 0.28.12 Fixed in 0.28.12 Patch available CNA
kysely (npm) Vendor— Affected 0.26.0 to before 0.28.12 Fixed in 0.28.12 Patch available GHSA-wmrf-hv6w-mr66

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:kysely:kysely::::::node.js::*	0.26.0 to before 0.28.12	Vulnerable	kysely-org

cpe:2.3:a:kysely:kysely:*:*:*:*:*:node.js:*:* Versions 0.26.0 to before 0.28.12 Vulnerable ·kysely-org

Remediation

Fix · CNA kysely (kysely-org) Fixed in 0.28.12
Fix · GHSA-wmrf-hv6w-mr66 kysely (npm) Fixed in 0.28.12 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-32763
2026-10-03 Alias added: GHSA-wmrf-hv6w-mr66

References

Other 2

TI-2026-25864 SQL injection in kysely-org kysely CVSS 3.1HIGH 8.1
TI-2026-25838 Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences