Vulnerability · Published Mar 26, 2026 · Assigned by GitHub_M

CVE-2026-33468Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings

High 8.1

In plain English

A high-severity SQL injection in kysely from kysely-org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 62.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`. Version 0.28.14 contains a fix.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	kysely	0.28.14	GHSA-8cpq-38p9-67gx

Affected products (as reported)

Vendor	Product	Versions
kysely-org	kysely	< 0.28.14

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/kysely-org/kysely/security/advisories/GHSA-8cpq-38p9-67gx x_refsource_CONFIRM