TI-2026-25838 Aliases CVE-2026-33442 GHSA-fr9j-6mvq-frcv

Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.

HIGH 70CWE-89Published 2026-03-26 · Updated 2026-03-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely's query compiler escapes single quotes (`'` → `''`) but does not escape backslashes. On MySQL with the default `BACKSLASH_ESCAPES` SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL. Version 0.28.14 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0045 39th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed kysely (kysely-org): 0.28.14kysely (npm): 0.28.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kysely-org	kysely	0.28.12 to before 0.28.14	0.28.14	Patch available	CNA
—	kysely (npm)	0.28.12 to before 0.28.14	0.28.14	Patch available	GHSA-fr9j-6mvq-frcv

kysely Vendorkysely-org Affected 0.28.12 to before 0.28.14 Fixed in 0.28.14 Patch available CNA
kysely (npm) Vendor— Affected 0.28.12 to before 0.28.14 Fixed in 0.28.14 Patch available GHSA-fr9j-6mvq-frcv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:kysely:kysely::::::node.js::*	0.28.12 to before 0.28.14	Vulnerable	kysely-org

cpe:2.3:a:kysely:kysely:*:*:*:*:*:node.js:*:* Versions 0.28.12 to before 0.28.14 Vulnerable ·kysely-org

Remediation

Fix · CNA kysely (kysely-org) Fixed in 0.28.14
Fix · GHSA-fr9j-6mvq-frcv kysely (npm) Fixed in 0.28.14 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-33442
2026-10-03 Alias added: GHSA-fr9j-6mvq-frcv

References

TI-2026-25254 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. CVSS 3.1HIGH 8.2
TI-2026-25864 SQL injection in kysely-org kysely CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences