CVE-2026-33442
Kysely is a type-safe TypeScript SQL query builder.
Published Mar 26, 2026 · updated Jun 17, 2026 · kysely kysely
Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the method in Kysely's query compiler escapes single quotes ( → ) but does not escape backslashes. On MySQL with the default SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL. Version 0.28.14 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2026 · NIST NVD
Detected
Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the method in Kysely's query compiler escapes single quotes ( → ) but does not escape backslashes. On MySQL with the default SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL. Version 0.28.14 fixes
Jun 17, 2026 · NIST NVD
Updated
Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the method in Kysely's query compiler escapes single quotes ( → ) but does not escape backslashes. On MySQL with the default SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL. Version 0.28.14 fixes
Affected
- cpe kysely/kyselyversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33442
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33442
Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the method in Kysely's query compiler escapes single quotes ( → ) but does not escape backslashes. On MySQL with the default SQL mode, an attack
nvd.nist.gov