CVE-2026-33442 Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.
Attackers can inject arbitrary SQL via backslash escape bypass in Kysely when using JSON path keys on MySQL.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33442?
CVE-2026-33442 is a high-severity SQL injection vulnerability in kysely-org kysely, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely's query compiler escapes single quotes (`'` → `''`) but does not escape backslashes. On MySQL with the default `BACKSLASH_ESCAPES` SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL. Version 0.28.14 fixes the issue.
Weakness: CWE-89
Which versions are affected by CVE-2026-33442?
2 open source packages ship an affected version, including kysely. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kysely npm | From 0.28.12 | 0.28.14 |
kysely npm | From 0.28.12 | 0.28.14 |
Products include Kysely Kysely.
How do I fix CVE-2026-33442?
Upgrade kysely to 0.28.14 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-33442 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33442 exists.
Other vulnerabilities in kysely-org kysely
- CVE-2026-32763 SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
- CVE-2026-33468 Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings
Sources
Also known as GHSA-fr9j-6mvq-frcv.