Loading vulnerability…
SQL Injection in Kysely sanitizeStringLiteral on MySQL JSON path handling
CVE-2026-33442 affects Kysely, a type-safe TypeScript SQL query builder. In Kysely versions 0.28.12 and 0.28.13, the query compiler's sanitizeStringLiteral method escapes single quotes by doubling them, but fails to escape backslashes. On MySQL systems using the default BACKSLASH_ESCAPES SQL mode, this allows an attacker to supply input containing a backslash immediately before a single quote, which neutralizes the intended escaping behavior. As a result, attacker-controlled input can break out of a JSON path string literal and inject arbitrary SQL into the resulting query. The issue is fixed in version 0.28.14.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary SQL injection in affected Kysely-generated queries under the described MySQL configuration. Depending on the privileges available to the application database account, this can result in unauthorized reading, modification, or deletion of data, execution of unintended SQL statements, and potential disruption of database-backed application functionality. The provided CVSS context indicates potential high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure by avoiding construction paths that place untrusted input into JSON path string literals through affected Kysely functionality. Where operationally feasible, review MySQL SQL mode configuration relevant to backslash escaping behavior, and enforce strict separation of untrusted input from SQL syntax. Additional defensive controls such as minimizing database account privileges can reduce impact, but they do not remediate the underlying flaw.
Patch, then assume compromise.
Upgrade Kysely to version 0.28.14 or later, which fixes the escaping flaw in sanitizeStringLiteral. Verify that deployments using MySQL and JSON path-related query construction are no longer running versions 0.28.12 or 0.28.13.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.