TI-2026-25864 Aliases CVE-2026-33468 GHSA-8cpq-38p9-67gx

SQL injection in kysely-org kysely

HIGH 70CWE-89Published 2026-03-26 · Updated 2026-03-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`. Version 0.28.14 contains a fix.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00426 37th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed kysely (kysely-org): 0.28.14kysely (npm): 0.28.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kysely-org	kysely	before 0.28.14	0.28.14	Patch available	CNA
—	kysely (npm)	before 0.28.14	0.28.14	Patch available	GHSA-8cpq-38p9-67gx

kysely Vendorkysely-org Affected before 0.28.14 Fixed in 0.28.14 Patch available CNA
kysely (npm) Vendor— Affected before 0.28.14 Fixed in 0.28.14 Patch available GHSA-8cpq-38p9-67gx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:kysely:kysely::::::node.js::*	before 0.28.14	Vulnerable	kysely-org

cpe:2.3:a:kysely:kysely:*:*:*:*:*:node.js:*:* Versions before 0.28.14 Vulnerable ·kysely-org

Remediation

Fix · CNA kysely (kysely-org) Fixed in 0.28.14
Fix · GHSA-8cpq-38p9-67gx kysely (npm) Fixed in 0.28.14 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-33468
2026-10-03 Alias added: GHSA-8cpq-38p9-67gx

References

TI-2026-25254 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. CVSS 3.1HIGH 8.2
TI-2026-25838 Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences