CVE-2026-33442: Kysely MySQL SQL Injection via Backslash Escape Bypass
Summary
CVE-2026-33442: Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. Affects kysely versions >= 0.28.12, < 0.28.14. Fixed in 0.28.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kysely is a type-safe SQL query builder for TypeScript that allows developers to construct SQL queries using a fluent API. It supports various databases, including MySQL, PostgreSQL, and SQLite. The package is designed to provide a seamless experience for building complex queries while ensuring type safety. However, a vulnerability has been identified that affects its JSON path builder functionality when used with MySQL, specifically in the context of backslash escape handling.
Vulnerability Detail
The vulnerability arises from the sanitizeStringLiteral method in Kysely's query compiler, which escapes single quotes but fails to escape backslashes. In MySQL's default BACKSLASH_ESCAPES mode, this oversight allows an attacker to inject a backslash before a single quote, effectively neutralizing the escaping mechanism. This leads to SQL injection vulnerabilities, enabling attackers to execute arbitrary SQL commands, potentially leading to data exfiltration, modification, or even full database compromise. The vulnerability is particularly critical as it can be exploited through user-controlled input passed to the .key() JSON path builder API.
How To Fix
Latest published version: 0.29.7 as of 23 Oct 2026
npm install kysely@0.29.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.28.14
This is the first release that contains the fix.
npm install kysely@0.28.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to manually sanitize user inputs before passing them to the .key() method. For example, you can replace backslashes and single quotes in user input as follows:
const sanitizedInput =
userInput.
replace(/\/g, '\\\\').replace(/'/g, "''");
This will help mitigate the risk until the package can be updated.
Conclusion
The vulnerability CVE-2026-33442 in Kysely poses a significant risk for applications using MySQL, allowing for SQL injection attacks through improper handling of backslashes. It is crucial to update to the latest version to mitigate this risk. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for kysely →
FAQ
CVE-2026-33442 is a vulnerability in the Kysely package that allows SQL injection through improper handling of backslashes in JSON path keys when used with MySQL.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Simply upload your package-lock.json file to the Vulert playground.
The vulnerability can lead to SQL injection, allowing attackers to read, modify, or delete data, and potentially compromise the entire database.
You can update Kysely to the patched version by running the command: npm install kysely@0.28.14 in your project directory.
Yes, you can sanitize user inputs by replacing backslashes and single quotes before passing them to the .key() method as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for kysely.
