Loading story…
Two high-severity SQL injection vulnerabilities were disclosed in Kysely, the TypeScript SQL query builder, affecting versions 0.28.12 and 0.28.13 in one case and versions prior to 0.28.14 in another. Both flaws stem from improper handling of backslashes in DefaultQueryCompiler.sanitizeStringLiteral(), which escaped single quotes but did not escape backslashes. In MySQL deployments using the default backslash-escape behavior, an attacker could place a backslash before a quote, break out of a string literal or JSON path string, and inject arbitrary SQL. Both issues are tracked as CWE-89 and carry a CVSS 3.1 score vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
The first issue, CVE-2026-33442, affects non-type-safe usage of JSON path keys, while CVE-2026-33468 impacts code paths that inline values into compiled SQL strings, including sql.lit(string)-style usage and components such as CreateIndexBuilder.where() and CreateViewBuilder.as() through ImmediateValueTransformer. GitHub security advisories were referenced for both disclosures, and the vendor fixed the vulnerabilities in Kysely 0.28.14, making upgrade the primary remediation for affected MySQL-backed applications.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Two CVEs were disclosed for Kysely covering related MySQL SQL injection scenarios: one involving non-type-safe JSON path key usage and another involving sql.lit(string) and similar inline string literal paths. Both advisories describe improper escaping of backslashes in sanitizeStringLiteral and reference a GitHub security advisory.
Kysely fixed SQL injection vulnerabilities caused by insufficient backslash escaping in string literal sanitization in version 0.28.14. The issues affected prior versions including 0.28.12 and 0.28.13 and could enable SQL injection in MySQL under default backslash-escape behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-62390**, an important-severity SQL injection vulnerability in Apache Kylin affecting versions **4 through 5.0.3**. The flaw is in a backend API used to refresh the table catalog cache, where improper neutralization of special elements can allow SQL injection in generated SQL statements. Apache said the issue is fixed in **Apache Kylin 5.0.4** and urged users to upgrade to that release. The vulnerability is tracked internally as **`KYLIN-6089`**, and credit for the discovery was given to **罗鑫**.
Jul 15, 2026
A critical SQL injection flaw tracked as **CVE-2026-54658** was disclosed in `@hypequery/clickhouse`, the TypeScript semantic layer for ClickHouse. The vulnerability affects versions prior to **2.0.2** and stems from improper parameter escaping in the `escapeValue()` function, which escaped single quotes but failed to escape backslashes first. An attacker controlling query parameters could supply a trailing backslash to escape the closing quote in a ClickHouse string literal and inject arbitrary SQL, resulting in potential compromise of confidentiality, integrity, and availability. The maintainers patched the issue in **version 2.0.2** by escaping backslashes before single quotes and added tests covering trailing backslashes, multiple backslashes, mixed backslash-and-quote cases, and multi-parameter injection attempts. The fix was published in the project commit, release notes, and changelog, which urge users to upgrade immediately; the disclosure also credits **Coby Geralnik (`@astelia`)** for responsibly reporting the bug.
Jul 29, 2026
A critical SQL injection flaw tracked as **`CVE-2026-69240`** affects **Sequelize** when used with the **Oracle** database dialect, exposing applications that run versions prior to **`6.37.4`**. The vulnerability lies in the ORM's `sql-string.js` escape logic, which fails to properly escape quotes when a supplied string begins with Oracle function names such as **`TO_DATE`** or **`TO_TIMESTAMP`**, causing attacker-controlled input to be inserted directly into generated SQL queries. The issue is rated **CVSS 9.8** and can be exploited remotely without authentication, potentially allowing attackers to bypass application controls, read sensitive data, alter or delete records, and execute arbitrary SQL expressions. Reports warn that in Oracle deployments with elevated database privileges, the impact could extend beyond the database to filesystem access or operating system command execution, creating a path to full host compromise. The vendor has released a fix in **`Sequelize 6.37.4`** and advises affected users to upgrade immediately.
Aug 4, 2026