Vulnerabilities

TI-2026-32535 CVE-2026-44635 · GHSA-pv5w-4p9q-p3v2

Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

HIGH 72

Kysely is a type-safe TypeScript SQL query builder.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00362 Published 2026-05-27 Fixed in 0.28.17 CWE-1284

TI-2026-25864 CVE-2026-33468 · GHSA-8cpq-38p9-67gx

HIGH 70

Kysely is a type-safe TypeScript SQL query builder.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00426 Published 2026-03-26 Fixed in 0.28.14 CWE-89

TI-2026-25838 CVE-2026-33442 · GHSA-fr9j-6mvq-frcv

HIGH 70

Kysely is a type-safe TypeScript SQL query builder.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0045 Published 2026-03-26 Fixed in 0.28.14 CWE-89

TI-2026-25254 CVE-2026-32763 · GHSA-wmrf-hv6w-mr66

HIGH 75

Kysely is a type-safe TypeScript SQL query builder.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00436 Published 2026-03-19 Fixed in 0.28.12 CWE-89