CVE-2026-33468 Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings
Attackers can inject arbitrary SQL via insufficient backslash escaping in Kysely's MySQL dialect, potentially leading to data theft or modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33468?
CVE-2026-33468 is a high-severity SQL injection vulnerability in kysely-org kysely, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`. Version 0.28.14 contains a fix.
Weakness: CWE-89
Which versions are affected by CVE-2026-33468?
2 open source packages ship an affected version, including kysely. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kysely npm | All versions | 0.28.14 |
kysely npm | All versions | 0.28.14 |
Products include Kysely Kysely.
How do I fix CVE-2026-33468?
Upgrade kysely to 0.28.14 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-33468 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33468 exists.
Other vulnerabilities in kysely-org kysely
Sources
Also known as GHSA-8cpq-38p9-67gx, MINI-6459-9wcc-52w5, MINI-g84g-q97h-rv2x.