CVE-2026-32763: Kysely SQL Injection Vulnerability via Unsanitized JSON Path Keys
Summary
CVE-2026-32763: Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. Affects kysely versions >= 0.26.0, < 0.28.12. Fixed in 0.28.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kysely is an open-source SQL query builder for TypeScript that provides a fluent API for constructing SQL queries. It supports various database dialects, including MySQL, SQLite, and PostgreSQL. The package is designed to facilitate the building of complex queries while maintaining type safety. However, a vulnerability has been identified in versions up to 0.28.11, where unsanitized JSON path keys can lead to SQL injection attacks.
Vulnerability Detail
The vulnerability arises from the visitJSONPathLeg() function in Kysely, which appends user-controlled values from .key() and .at() directly into single-quoted JSON path string literals without proper escaping. This oversight allows an attacker to break out of the JSON path string context and inject arbitrary SQL commands. The affected dialects are MySQL and SQLite, while PostgreSQL is not impacted. The potential ramifications include unauthorized data access and manipulation through crafted JSON key names, enabling attackers to perform UNION-based data exfiltration from any database table.
How To Fix
Latest published version: 0.29.7 as of 23 Oct 2026
npm install kysely@0.29.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.28.12
This is the first release that contains the fix.
npm install kysely@0.28.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can escape single quotes in JSON path values within the visitJSONPathLeg() function. For example, modify the code to include a sanitization step that doubles single quotes before appending them to the JSON path string. Here is a conceptual example:
visitJSONPathLeg(node) {
const isArrayLocation = node.type === 'ArrayLocation';
this.append(isArrayLocation ? '[' : '.');
this.append(String(node.value).replace(/'/g, "''")); // Escape single quotes
if (isArrayLocation) {
this.append(']');
}
}
Conclusion
The Kysely SQL injection vulnerability (CVE-2026-32763) poses a significant risk to applications using affected versions of the package. It is crucial to update to the patched version or implement workarounds to safeguard against potential SQL injection attacks. Regular monitoring with tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for kysely →
FAQ
The vulnerability is an SQL injection that occurs due to unsanitized JSON path keys in Kysely, allowing attackers to inject arbitrary SQL.
Kysely versions up to 0.28.11 are affected by this vulnerability. Version 0.28.12 and later contain the fix.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
An attacker could exploit this vulnerability to gain unauthorized access to sensitive data by injecting SQL commands that can exfiltrate data from any database table.
If an immediate update is not possible, implement the suggested workaround to escape single quotes in JSON path values to mitigate the risk temporarily.
References
Related vulnerabilities
Recent vulnerabilities recorded for kysely.
