kysely-org kysely

• CVE-2026-44635 High 7.5 Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` 0.4%
• CVE-2026-33468 High 8.1 Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings 0.4%
• CVE-2026-33442 High 8.1 Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. 0.4%
• CVE-2026-32763 High 8.2 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. 0.4%