SQL Injection

Overview kysely is a Type safe SQL query builder Affected versions of this package are vulnerable to SQL Injection via the sanitizeStringLiteral function. An attacker can execute arbitrary SQL commands by supplying specially crafted input containing backslashes and single quotes, which are not...

@mikro-orm/entity-generator (>=7.0.2-dev.17, <=7.0.5-dev.1), @mikro-orm/libsql (>=7.0.2-dev.17, <=7.0.5-dev.1) +11 more potentially affected by CVE-2026-33442 via kysely (>=0.28.12, <=0.28.13)

kysely NPM version =0.28.12, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.5-dev.1 - @omnitron-dev/omnitron 0.1.3 - @omnitron-dev/testing 0.1.3 - @omnitron-dev/titan-database 0.1.3 Source...

SQL Injection

Overview kysely is a Type safe SQL query builder Affected versions of this package are vulnerable to SQL Injection via the visitJSONPathLeg function, which appends user-controlled values from .key and .at directly into single-quoted JSON path string literals without proper escaping. An attacker c...

@abiswas97/postgres-mcp (2.0.0), @ampt/sql (1.0.1) +631 more potentially affected by CVE-2026-32763 via kysely (>=0.26.3, <=0.28.11)

kysely NPM version =0.26.3, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =2.7.6, =0.2.0, =0.0.1, =0.0.17, =0.0.2, =0.0.65, =1.0.24, =1.2.23, =1.2.27 and more Source cves: CVE-2026-32763 Source advisory: SNYK:JS-KYSELY-15763565...

CVE-2026-32763

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg function appends user-controlled values from .key and .at directly into single-quoted JSON path...

Kysely SQL注入漏洞

Kysely is a type-safe TypeScript SQL query builder developed by Kysely. Versions of Kysely 0.28.11 and earlier contained an SQL injection vulnerability. This vulnerability stemmed from JSON path compilation where single quotes were not escaped, allowing SQL injections to occur...

CVE-2026-32763 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg function appends user-controlled values from .key and .at directly into single-quoted JSON path...

CVE-2026-32763

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg function appends user-controlled values from .key and .at directly into single-quoted JSON path...

CVE-2026-32763 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg function appends user-controlled values from .key and .at directly into single-quoted JSON path...

CVE-2026-32763

Summary: CVE-2026-32763 affects Kysely up to v0.28.11, where the JSON path compilation in the MySQL/SQLite dialects is vulnerable. The root cause is that visitJSONPathLeg() appends user-controlled values from .key() and .at() directly into single-quoted JSON path literals ('$.key') without escapi...

CVE-2026-32763 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg function appends user-controlled values from .key and .at directly into single-quoted JSON path...

@abiswas97/postgres-mcp (2.0.0), @ampt/sql (1.0.1) +631 more potentially affected by CVE-2026-32763 via kysely (>=0.26.3, <=0.28.11)

kysely NPM version =0.26.3, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =2.7.6, =0.2.0, =0.0.1, =0.0.17, =0.0.2, =0.0.65, =1.0.24, =1.2.23, =1.2.27 and more Source cves: CVE-2026-32763 Source advisory: OSV:GHSA-WMRF-HV6W-MR66...

GHSA-WMRF-HV6W-MR66 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

Summary Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg function appends user-controlled values from .key and .at directly into single-quoted JSON path string literals '$.key' without escaping single quotes. An...

SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

Summary Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg function appends user-controlled values from .key and .at directly into single-quoted JSON path string literals '$.key' without escaping single quotes. An...

PT-2026-26090

Name of the Vulnerable Software and Affected Versions Kysely versions up to and including 0.28.11 Description Kysely, a type-safe TypeScript SQL query builder, has a SQL injection issue in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg function directly appends...