SQL Injection Vulnerability in Kysely's Type-Safe TypeScript Query Builder

CVE-2026-32763

What is CVE-2026-32763?

Kysely, a type-safe TypeScript SQL query builder, has a vulnerability affecting versions up to 0.28.11, which can lead to SQL injection. This vulnerability arises from the visitJSONPathLeg() function, where user-supplied values added to JSON path strings are not properly escaped. Specifically, single quotes are directly appended to JSON path string literals, allowing an attacker to manipulate the SQL context and execute arbitrary SQL commands. While identifiers are protected through proper sanitization, the vulnerability enables exploitation due to the inadequate handling of JSON paths. The issue has been resolved in version 0.28.12.

References