CVE-2026-33442Disclosure(kysely / kysely)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely's query compiler escapes single quotes (`'` → `''`) but does not escape backslashes. On MySQL with the default `BACKSLASH_ESCAPES` SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL. Version 0.28.14 fixes the issue.

kysely CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/kysely-org/kysely/security/advisories/GHSA-fr9j-6mvq-frcv

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kysely

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 1d ago at 3 mentions (2026-03-26); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

kysely

Products

kysely

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-26	3	Disclosure3
2026-03-29	1	Disclosure1

Full discourse4 posts

PulsePatch.io@pulsepatchio193d
Disclosure
`Kysely` has a MySQL SQL Injection via Backslash Escape Bypass (CVE-2026-33442). Attackers could execute arbitrary SQL. Review `Kysely` usage with MySQL for non-type-safe JSON path keys. #SQLi #Kysely #InfoSec https://www.pulsepatch.io/posts/cve-2026-33442-kysely-mysql-sql-injection
Post summary
Kysely is vulnerable to a MySQL SQL injection via backslash escape bypass (CVE‑2026‑33442), allowing attackers to execute arbitrary SQL. No proof of concept, exploit code, patch, or active exploitation details are provided.
0000073
6 followersView on X
The Hacker Wire@TheHackerWire196d
Disclosure
🟠 CVE-2026-33442 - High Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely's query compiler escapes single quotes (`'` → `''`) but doe... https://www.thehackerwire.com/vulnerability/CVE-2026-33442/ https://t.co/8ZeX7otM7d
Post summary
The post announces CVE‑2026‑33442 as a high‑severity issue in Kysely’s query compiler, highlighting a faulty string‑literal sanitization in specific versions. No PoC, exploit or patch details are provided, making it a straightforward disclosure.
0000056
163 followersView on X
Infoflowcloud@infoflowcloud196d
Disclosure
🚨*CVE* CVE-2026-33442 Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely's query compiler escapes single quot… https://www.cve.org/CVERecord?id=CVE-2026-33442 ----- Traducción: CVE-2026-33442 Kys… http://infoflow.cloud`
Post summary
The tweet reports CVE‑2026‑33442, detailing that Kysely versions 0.28.12‑0.28.13 have a flaw in the sanitizeStringLiteral method; no PoC, exploit, or patch information is provided.
0000049
65 followersView on X
CVE@CVEnew196d
Disclosure
CVE-2026-33442 Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely's query compiler escapes single quot… https://www.cve.org/CVERecord?id=CVE-2026-33442
Post summary
The excerpt announces that Kysely versions 0.28.12 and 0.28.13 contain a vulnerability (CVE-2026-33442) where the `sanitizeStringLiteral` method mishandles single quotes.
00000268
56.9K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	kysely	kysely	-	node.js	-

Explore more

Back to dashboard kysely CVEs kysely vulnerabilities

What researchers are saying

CVE-2026-33442

PulsePatch.io@pulsepatchioDisclosure

Kysely is vulnerable to a MySQL SQL injection via backslash escape bypass (CVE‑2026‑33442), allowing attackers to execute arbitrary SQL. No proof of concept, exploit code, patch, or active exploitation details are provided.

The Hacker Wire@TheHackerWireDisclosure

The post announces CVE‑2026‑33442 as a high‑severity issue in Kysely’s query compiler, highlighting a faulty string‑literal sanitization in specific versions. No PoC, exploit or patch details are provided, making it a straightforward disclosure.

Infoflowcloud@infoflowcloudDisclosure

The tweet reports CVE‑2026‑33442, detailing that Kysely versions 0.28.12‑0.28.13 have a flaw in the sanitizeStringLiteral method; no PoC, exploit, or patch information is provided.

CVE@CVEnewDisclosure

The excerpt announces that Kysely versions 0.28.12 and 0.28.13 contain a vulnerability (CVE-2026-33442) where the `sanitizeStringLiteral` method mishandles single quotes.