@agent-native/core (>=0.0.0-beta-20260819155526, <=1.1.0-nightly-20260831181857), @agent-native/skills (>=0.0.0-beta-20260819155526, <=0.2.726-nightly-20260915095940) +148 more potentially affected by unknown CVE via @better-auth/kysely-adapter (>=1.6.17, <=1.7.0-rc.6)

@better-auth/kysely-adapter NPM version =1.6.17, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.28.0, =0.1.1, =1.0.0, =1.9.0 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 - @arxen/governance 0.2.0 - @arxen/next 0.2.0 - @arxen/organization 0.2.0 -...

@agent-native/core (>=0.0.0-beta-20260819155526, <=1.1.0-nightly-20260831181857), @agent-native/skills (>=0.0.0-beta-20260819155526, <=0.2.726-nightly-20260915095940) +148 more potentially affected by CVE-2026-110861 via @better-auth/kysely-adapter (>=1.6.17, <=1.7.0-rc.6)

@better-auth/kysely-adapter NPM version =1.6.17, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.28.0, =0.1.1, =1.0.0, =1.9.0 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 - @arxen/governance 0.2.0 - @arxen/next 0.2.0 - @arxen/organization 0.2.0 -...

Brute Force

Overview @better-auth/kysely-adapter is a Kysely adapter for Better Auth Affected versions of this package are vulnerable to Brute Force via a race condition in the compare-and-swap UPDATE path in drizzle-adapter.ts and relations-v2/index.ts. Under PostgreSQL's READ COMMITTED isolation, the WHERE...

@agent-native/core (>=0.0.0-beta-20260819155526, <=1.1.0-nightly-20260831181857), @agent-native/skills (>=0.0.0-beta-20260819155526, <=0.2.726-nightly-20260915095940) +148 more potentially affected by CVE-2026-110861 via @better-auth/kysely-adapter (>=1.6.17, <=1.7.0-rc.6)

@better-auth/kysely-adapter NPM version =1.6.17, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.28.0, =0.1.1, =1.0.0, =1.9.0 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 - @arxen/governance 0.2.0 - @arxen/next 0.2.0 - @arxen/organization 0.2.0 -...

CVE-2026-110861 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can se...

@agent-native/core (>=0.0.0-beta-20260819155526, <=1.1.0-nightly-20260831181857), @agent-native/skills (>=0.0.0-beta-20260819155526, <=0.2.726-nightly-20260915095940) +148 more potentially affected by CVE-2026-110861 via @better-auth/kysely-adapter (>=1.6.17, <=1.7.0-rc.6)

@better-auth/kysely-adapter NPM version =1.6.17, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.0.7, =0.28.0, =0.1.1, =1.0.0, =1.9.0 - @arxen/access-control 0.2.0 - @arxen/cli 0.2.0 - @arxen/core 0.2.0 - @arxen/governance 0.2.0 - @arxen/next 0.2.0 - @arxen/organization 0.2.0 -...

CVE-2026-110861

The Better Auth library, specifically the @better-auth/drizzle-adapter (versions 1.6.17 to 1.7.7), better-auth (versions 1.6.17 to 1.7.7), and @better-auth/kysely-adapter (versions 1.6.17 to 1.7.0), contains a race condition in its database-backed rate limiting when used with PostgreSQL . The roo...

PT-2026-114175

Name of the Vulnerable Software and Affected Versions better-auth versions 1.6.17 through 1.7.6 @better-auth/drizzle-adapter versions 1.6.17 through 1.7.6 @better-auth/kysely-adapter versions 1.6.17 through 1.6.9 Description A race condition exists in database-backed rate limiting on PostgreSQL...

CVE-2026-44635

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters ., , , , , ?. When attacker-controlled input flows into eb.refcol, '-$'.keyinput or .atinput — including type-safe code where the JSON column ...

CVE-2026-44635

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters ., , , , , ?. When attacker-controlled input flows into eb.refcol, '-$'.keyinput or .atinput — including type-safe code where the JSON column ...

CVE-2026-44635 Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters ., , , , , ?. When attacker-controlled input flows into eb.refcol, '-$'.keyinput or .atinput — including type-safe code where the JSON column ...

@abiswas97/postgres-mcp (2.0.0), @adlanarifzr/mikro-orm-migrations (>=7.0.5-next.0, <=7.0.9) +694 more potentially affected by CVE-2026-44635 via kysely (>=0.26.3, <=0.28.16)

kysely NPM version =0.26.3, =7.0.5-next.0, =7.0.5-next.0, =1.0.1, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =2.7.6, =0.2.0, =0.0.1, =0.0.17, =0.0.78 and more Source cves: CVE-2026-44635 Source advisory: MEND:CVE-2026-44635...

EUVD-2026-32623

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters ., , , , , ?. When attacker-controlled input flows into eb.refcol, '-$'.keyinput or .atinput — including type-safe code where the JSON column ...

CVE-2026-44635

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters ., , , , , ?. When attacker-controlled input flows into eb.refcol, '-$'.keyinput or .atinput — including type-safe code where the JSON column ...

CVE-2026-44635

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters ., , , , , ?. When attacker-controlled input flows into eb.refcol, '-$'.keyinput or .atinput — including type-safe code where the JSON column ...

CVE-2026-44635

Kysely CVE-2026-44635 affects versions 0.26.0 through 0.28.16. The vulnerability resides in the JSON path builder: DefaultQueryCompiler.visitJSONPathLeg and related code do not escape JSON-path metacharacters (., [, ], *, **, ?). Attacker-controlled input used in eb.ref(col, '-&gt;$').key(input) ...

CVE-2026-44635 Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters ., , , , , ?. When attacker-controlled input flows into eb.refcol, '-$'.keyinput or .atinput — including type-safe code where the JSON column ...

CVE-2026-44635: Improper Limitation of a Pathname to a Restricted Directory

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters ., , , , , ?. When attacker-controlled input flows into eb.refcol, '-$'.keyinput or .atinput — including type-safe code where the JSON column ...

Kysely security vulnerabilities

Kysely is a type-safe TypeScript SQL query builder developed by Kysely contributors. Versions of Kysely from 0.26.0 to 0.28.16 contain security vulnerabilities. These vulnerabilities stem from the lack of escaping of JSON path metacharacters in the DefaultQueryCompiler.visitJSONPathLeg function. ...

NPM: Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

NPM: Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in JSONPathBuilder.key / .at vulnerability discovered by ? in WordPress Npm kysely versions = 0.26.0, 0.28.17...