CVE-2026-33442

Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the "sanitizeStringLiteral" method in Kysely's query compiler escapes single quotes "'" → "''" but does not escape backslashes. On MySQL with the default "BACKSLASHESCAPES" SQL mode, an attacker can inject a...

Kysely SQL injection vulnerability

Kysely is a type-safe TypeScript SQL query builder developed by Kysely. Versions of Kysely prior to 0.28.14 contained an SQL injection vulnerability. This vulnerability stemmed from the sanitizeStringLiteral method not escaping backslashes, which could lead to SQL injection attacks...

Kysely SQL injection vulnerability

Kysely is a type-safe TypeScript SQL query builder developed by Kysely. Versions of Kysely prior to 0.28.14 contained an SQL injection vulnerability. This vulnerability stemmed from the sanitizeStringLiteral method not escaping backslashes, which could lead to SQL injection attacks...

CVE-2026-33442: Improper Neutralization of Special Elements used in an SQL Command

Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the sanitizeStringLiteral method in Kysely's query compiler escapes single quotes ' → '' but does not escape backslashes. On MySQL with the default BACKSLASHESCAPES SQL mode, an attacker can inject a backslash...