CVE-2026-33468
Kysely is a type-safe TypeScript SQL query builder.
Published Mar 26, 2026 · updated Jun 17, 2026 · kysely kysely
Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's only escapes single quotes by doubling them ( → ) but does not escape backslashes. When used with the MySQL dialect (where is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses to inline values — specifically and . Version 0.28.14 contains a fix.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2026 · NIST NVD
Detected
Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's only escapes single quotes by doubling them ( → ) but does not escape backslashes. When used with the MySQL dialect (where is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code pa
Jun 17, 2026 · NIST NVD
Updated
Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's only escapes single quotes by doubling them ( → ) but does not escape backslashes. When used with the MySQL dialect (where is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code pa
Affected
- cpe kysely/kyselyversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33468
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33468
Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's only escapes single quotes by doubling them ( → ) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ES
nvd.nist.gov