Kysely MySQL SQL Injection Flaws Fixed in Version 0.28.14

Two high-severity SQL injection vulnerabilities were disclosed in Kysely, the TypeScript SQL query builder, affecting versions 0.28.12 and 0.28.13 in one case and versions prior to 0.28.14 in another. Both flaws stem from improper handling of backslashes in DefaultQueryCompiler.sanitizeStringLiteral(), which escaped single quotes but did not escape backslashes. In MySQL deployments using the default backslash-escape behavior, an attacker could place a backslash before a quote, break out of a string literal or JSON path string, and inject arbitrary SQL. Both issues are tracked as CWE-89 and carry a CVSS 3.1 score vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

The first issue, CVE-2026-33442, affects non-type-safe usage of JSON path keys, while CVE-2026-33468 impacts code paths that inline values into compiled SQL strings, including sql.lit(string)-style usage and components such as CreateIndexBuilder.where() and CreateViewBuilder.as() through ImmediateValueTransformer. GitHub security advisories were referenced for both disclosures, and the vendor fixed the vulnerabilities in Kysely 0.28.14, making upgrade the primary remediation for affected MySQL-backed applications.