Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-44635Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

High 7.5

In plain English

A high-severity path traversal in kysely from kysely-org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 69.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (., [, ], *, **, ?). When attacker-controlled input flows into eb.ref(col, '->$').key(input) or .at(input) — including type-safe code where the JSON column is shaped like Record<string, T> so K extends string is the inferred type — every dot becomes a path-leg separator, letting an attacker traverse from the intended key into sibling and child fields the developer never meant to expose. The result is read access (and, in update statements, write access) to JSON sub-fields outside the intended scope across MySQL, PostgreSQL ->$/->>$, and SQLite. This vulnerability is fixed in 0.28.17.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	kysely	0.28.17	GHSA-pv5w-4p9q-p3v2

Affected products (as reported)

Vendor	Product	Versions
kysely-org	kysely	>= 0.26.0, < 0.28.17

Weakness: CWE-22, CWE-89, CWE-915, CWE-1284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/kysely-org/kysely/security/advisories/GHSA-pv5w-4p9q-p3v2 x_refsource_CONFIRM