Type-safe TypeScript SQL Query Builder Vulnerability in Kysely

CVE-2026-44635

What is CVE-2026-44635?

The Kysely SQL query builder contains a flaw in DefaultQueryCompiler.visitJSONPathLeg, which fails to properly escape JSON-path metacharacters such as ., [, ], *, **, and ?. An attacker can exploit this by injecting controlled input into methods like eb.ref(col, '->$').key(input) or .at(input). This allows for unauthorized traversal of JSON sub-fields that should not be exposed, potentially leading to read and write access to sensitive data outside of the developer's intended scope, affecting databases like MySQL, PostgreSQL, and SQLite. The issue is resolved in version 0.28.17.

References