Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Kysely 0.28.12 added a sanitizeStringLiteral() call inside DefaultQueryCompiler.visitJSONPathLeg (commit 0a602bf, PR #1727) to fix CVE-2026-32763 (GHSA-wmrf-hv6w-mr66). The fix only doubles single quotes (' → ''); it does not escape JSON-path metacharacters (., [, ], , , ?). When attacker-controlled input flows into eb.ref(col, '-$').key(input) or .at(input) — including type-safe code where the JSON column is shaped like Record<string, T so K extends string is the inferred type — every dot becomes a path-leg separator, letting an attacker traverse from the intended key into sibling and child fields the developer never meant to expose. The result is read access (and, in update statements, write access) to JSON sub-fields outside the intended scope across MySQL, PostgreSQL -$/-$, and SQLite. Project: Kysely — TypeScript SQL query builder (npm kysely); affects MySQL, PostgreSQL -$/-$, and SQLite dialects. Source reviewed: kysely-org/kysely @ master (73192e4, version 0.28.16).…
Recommended action: Upgrade to 0.28.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Kysely's DefaultQueryCompiler.sanitizeStringLiteral() only escapes single quotes by doubling them (' → '') but does not escape backslashes. When used with the MySQL dialect (where NOBACKSLASHESCAPES is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses ImmediateValueTransformer to inline values — specifically CreateIndexBuilder.where() and CreateViewBuilder.as(). Details The root cause is in DefaultQueryCompiler.sanitizeStringLiteral(): src/query-compiler/default-query-compiler.ts:1819-1821 Where LITWRAPREGEX is defined as /'/g (line 121). This only doubles single quotes — it does not escape backslash characters. The function is called from appendStringLiteral() which wraps the sanitized value in single quotes: src/query-compiler/default-query-compiler.ts:1841-1845 This is reached when visitValue() encounters an immediate value…
Recommended action: Upgrade to 0.28.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The sanitizeStringLiteral method in Kysely's query compiler escapes single quotes (' → '') but does not escape backslashes. On MySQL with the default BACKSLASHESCAPES SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL. Details When a user calls .key(value) on a JSON path builder, the value flows through: 1. JSONPathBuilder.key(key) at src/query-builder/json-path-builder.ts:166 stores the key as a JSONPathLegNode with type 'Member'. 2. During compilation, DefaultQueryCompiler.visitJSONPath() at src/query-compiler/default-query-compiler.ts:1609 wraps the full path in single quotes ('$...'). 3. DefaultQueryCompiler.visitJSONPathLeg() at src/query-compiler/default-query-compiler.ts:1623 calls sanitizeStringLiteral(node.value) for string values (line 1630). 4. sanitizeStringLiteral() at src/query-compiler/default-query-compiler.ts:1819-1821 only doubles single…
Recommended action: Upgrade to 0.28.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key() and .at() directly into single-quoted JSON path string literals ('$.key') without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with sanitizeIdentifier(), which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Details visitJSONPath() wraps JSON path in single quotes ('$...'), and visitJSONPathLeg() appends each key/index value via this.append(String(node.value)) with no sanitization: Contrast with sanitizeIdentifier() in the same file, which properly doubles delimiter characters: Both identifiers and JSON path keys are non-parameterizable SQL constructs that require manual escaping. Identifiers are…
Recommended action: Upgrade to 0.28.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.