CVE-2026-33468
Description
Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's DefaultQueryCompiler.sanitizeStringLiteral() only escapes single quotes by doubling them (' → '') but does not escape backslashes. When used with the MySQL dialect (where NO_BACKSLASH_ESCAPES is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses ImmediateValueTransformer to inline values — specifically CreateIndexBuilder.where() and CreateViewBuilder.as(). Version 0.28.14 contains a fix.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
kyselynpm | < 0.28.14 | 0.28.14 |
Affected products
12- osv-coords11 versionspkg:apk/chainguard/langfuse-2pkg:apk/chainguard/langfuse-2-workerpkg:apk/chainguard/langfuse-3pkg:apk/chainguard/langfuse-3-workerpkg:apk/chainguard/langfuse-fips-2pkg:apk/chainguard/langfuse-fips-2-workerpkg:apk/chainguard/langfuse-fips-3pkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/wolfi/langfuse-3pkg:apk/wolfi/langfuse-3-workerpkg:npm/kysely
< 2.95.12-r15+ 10 more
- (no CPE)range: < 2.95.12-r15
- (no CPE)range: < 2.95.12-r16
- (no CPE)range: < 3.162.0-r1
- (no CPE)range: < 3.163.0-r0
- (no CPE)range: < 2.95.12-r18
- (no CPE)range: < 2.95.12-r19
- (no CPE)range: < 3.162.0-r0
- (no CPE)range: < 3.162.0-r1
- (no CPE)range: < 3.162.0-r1
- (no CPE)range: < 3.163.0-r0
- (no CPE)range: < 0.28.14
Patches
Vulnerability mechanics
References
3- github.com/kysely-org/kysely/security/advisories/GHSA-8cpq-38p9-67gxnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-8cpq-38p9-67gxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33468ghsaADVISORY
News mentions
0No linked articles in our index yet.