CVE-2026-32763 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
Attackers can inject arbitrary SQL via unsanitized JSON path keys in Kysely, potentially leading to data theft or modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32763?
CVE-2026-32763 is a high-severity SQL injection vulnerability in kysely-org kysely, published on 19 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals (`'$.key'`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with `sanitizeIdentifier()`, which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Version 0.28.12 fixes the issue.
Weakness: CWE-89
Which versions are affected by CVE-2026-32763?
2 open source packages ship an affected version, including kysely. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kysely npm | From 0.26.0 | 0.28.12 |
kysely npm | From 0.26.0 | 0.28.12 |
Products include Kysely Kysely.
How do I fix CVE-2026-32763?
Upgrade kysely to 0.28.12 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-32763 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32763 exists.
Other vulnerabilities in kysely-org kysely
- CVE-2026-33442 Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.
- CVE-2026-33468 Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings
Sources
Also known as GHSA-wmrf-hv6w-mr66, MINI-gxqc-96r5-6j9x, MINI-h72c-jg4j-fcr3.