High severity8.1NVD Advisory· Published Mar 26, 2026· Updated Mar 31, 2026
CVE-2026-33442
CVE-2026-33442
Description
Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the sanitizeStringLiteral method in Kysely's query compiler escapes single quotes (' → '') but does not escape backslashes. On MySQL with the default BACKSLASH_ESCAPES SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL. Version 0.28.14 fixes the issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
kyselynpm | >= 0.28.12, < 0.28.14 | 0.28.14 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/kysely-org/kysely/security/advisories/GHSA-fr9j-6mvq-frcvnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-fr9j-6mvq-frcvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33442ghsaADVISORY
News mentions
0No linked articles in our index yet.