Read the docs
TI-2026-32535 Aliases CVE-2026-44635GHSA-pv5w-4p9q-p3v2

Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

Priority HIGH 72CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, SQL injection, Tampering
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22, CWE-89, CWE-915 and the CVSS impact.

Summary

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (., [, ], *, **, ?). When attacker-controlled input flows into eb.ref(col, '->$').key(input) or .at(input) — including type-safe code where the JSON column is shaped like Record<string, T> so K extends string is the inferred type — every dot becomes a path-leg separator, letting an attacker traverse from the intended key into sibling and child fields the developer never meant to expose. The result is read access (and, in update statements, write access) to JSON sub-fields outside the intended scope across MySQL, PostgreSQL ->$/->>$, and SQLite. This vulnerability is fixed in 0.28.17.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00362 30th percentileScored 2026-11-07
Fix Fixed kysely (kysely-org): 0.28.17kysely (npm): 0.28.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kysely-orgkysely0.26.0 to before 0.28.170.28.17Patch availableCNA
—kysely (npm)0.26.0 to before 0.28.170.28.17Patch availableGHSA-pv5w-4p9q-p3v2
  • kysely Vendorkysely-org Affected 0.26.0 to before 0.28.17 Fixed in 0.28.17 Patch available CNA
  • kysely (npm) Vendor— Affected 0.26.0 to before 0.28.17 Fixed in 0.28.17 Patch available GHSA-pv5w-4p9q-p3v2

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:kysely:kysely:*:*:*:*:*:*:*:*——kysely-org
  • cpe:2.3:a:kysely:kysely:*:*:*:*:*:*:*:* Versions — — ·kysely-org

Remediation

  • Fix · CNA kysely (kysely-org) Fixed in 0.28.17
  • Fix · GHSA-pv5w-4p9q-p3v2 kysely (npm) Fixed in 0.28.17 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44635
  2. 2026-10-03 Alias added: GHSA-pv5w-4p9q-p3v2

References

Advisory 1

Other 3

  • TI-2026-25254 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. CVSS 3.1HIGH 8.2
  • TI-2026-25864 SQL injection in kysely-org kysely CVSS 3.1HIGH 8.1
  • TI-2026-25838 Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences