CVE-2026-33468: Kysely MySQL SQL Injection via Insufficient Backslash Escaping
Summary
CVE-2026-33468: Kysely's DefaultQueryCompiler.sanitizeStringLiteral() only escapes single quotes by doubling them (' → '') but does not escape backslashes. Affects kysely versions < 0.28.14. Fixed in 0.28.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kysely is a powerful SQL query builder for TypeScript that allows developers to construct complex SQL queries in a type-safe manner. It supports various database dialects, including MySQL, and is designed to facilitate database interactions while ensuring type safety and ease of use. However, a critical vulnerability has been identified in its handling of string literals in MySQL, which can lead to SQL injection attacks if user input is not properly sanitized.
Vulnerability Detail
The vulnerability arises from Kysely's DefaultQueryCompiler.sanitizeStringLiteral() method, which only escapes single quotes by doubling them but fails to escape backslashes. In MySQL, where NO_BACKSLASH_ESCAPES is OFF by default, an attacker can exploit this oversight by injecting backslashes into string literals. This allows them to escape the trailing quote of a string literal, effectively breaking out of the string context and injecting arbitrary SQL commands. The affected methods include CreateIndexBuilder.where() and CreateViewBuilder.as(), which can lead to severe consequences such as data exfiltration, data modification, and authentication bypass.
How To Fix
Latest published version: 0.29.7 as of 23 Oct 2026
npm install kysely@0.29.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.28.14
This is the first release that contains the fix.
npm install kysely@0.28.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing untrusted user input directly into CreateIndexBuilder.where() or CreateViewBuilder.as() methods. Instead, consider using parameterized queries where possible to prevent SQL injection.
Conclusion
The Kysely package has a critical vulnerability (CVE-2026-33468) that can lead to SQL injection attacks due to improper handling of string literals in MySQL. It is essential to update to version 0.28.14 or later to mitigate this risk. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for kysely →
FAQ
CVE-2026-33468 is a vulnerability in the Kysely package that allows for SQL injection attacks due to insufficient escaping of backslashes in MySQL string literals.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to use the Vulert playground without signup.
The vulnerability can lead to SQL injection, allowing attackers to read arbitrary data, modify or delete data, and potentially bypass authentication controls.
You can update the Kysely package by running the command 'npm install kysely@0.28.14' in your project directory to ensure you have the patched version.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for kysely.
