Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings

🗓️ 20 Mar 2026 20:48:55Reported by GitHub Advisory DatabaseType

Kysely MySQL SQL injection from backslashes not escaped in string literals via ImmediateValueTransformer in where and as.

Reporter	Title	Published	Views	Family All 18
ATTACKERKB	CVE-2026-33468	26 Mar 202617:03	–	attackerkb
Chainguard	CVE-2026-33468 vulnerabilities	2 Apr 202607:17	–	cgr
Circl	CVE-2026-33468	20 Mar 202617:48	–	circl
CNNVD	Kysely SQL注入漏洞	26 Mar 202600:00	–	cnnvd
CVE	CVE-2026-33468	26 Mar 202617:03	–	cve
Cvelist	CVE-2026-33468 Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings	26 Mar 202617:03	–	cvelist
NVD	CVE-2026-33468	26 Mar 202617:16	–	nvd
OSV	CGA-7MCX-XCJH-V997	26 Mar 202606:15	–	osv
OSV	CVE-2026-33468 Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings	26 Mar 202617:03	–	osv
OSV	GHSA-8CPQ-38P9-67GX Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings	20 Mar 202620:48	–	osv

Vulners

Node

kysely kyselyRange≤0.28.13npm

Source	Link
github	www.github.com/kysely-org/kysely/security/advisories/GHSA-8cpq-38p9-67gx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33468
github	www.github.com/advisories/GHSA-8cpq-38p9-67gx

27 Mar 2026 20:57Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.18.1

EPSS0.00419

SSVC