{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3akyselykyselynode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kysely:kysely:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-32763"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MySQL","PostgreSQL","SQLite","kysely"],"_cs_severities":["high"],"_cs_tags":["jsonpath","injection","kysely","cwe-89","cwe-915","cwe-1284"],"_cs_type":"advisory","_cs_vendors":["MySQL","PostgreSQL","SQLite"],"content_html":"\u003cp\u003eA JSON-path injection vulnerability has been identified in Kysely, a TypeScript SQL query builder, affecting MySQL, PostgreSQL \u003ccode\u003e-\u0026gt;$\u003c/code\u003e/\u003ccode\u003e-\u0026gt;\u0026gt;$\u003c/code\u003e, and SQLite dialects. The vulnerability stems from insufficient sanitization of JSON-path metacharacters (\u003ccode\u003e.\u003c/code\u003e, \u003ccode\u003e[\u003c/code\u003e, \u003ccode\u003e]\u003c/code\u003e, \u003ccode\u003e*\u003c/code\u003e, \u003ccode\u003e**\u003c/code\u003e, \u003ccode\u003e?\u003c/code\u003e) in the \u003ccode\u003eJSONPathBuilder.key()\u003c/code\u003e and \u003ccode\u003e.at()\u003c/code\u003e functions.  Specifically, Kysely 0.28.12 added a \u003ccode\u003esanitizeStringLiteral()\u003c/code\u003e call inside \u003ccode\u003eDefaultQueryCompiler.visitJSONPathLeg\u003c/code\u003e (commit \u003ccode\u003e0a602bf\u003c/code\u003e, PR #1727) to fix CVE-2026-32763 (\u003ccode\u003eGHSA-wmrf-hv6w-mr66\u003c/code\u003e), however this fix only escapes single quotes, and not the other JSON-path metacharacters. This allows attackers to traverse from the intended key into sibling and child fields, potentially exposing sensitive data that was intended to be private. The vulnerability can be exploited even in type-safe code where the JSON column is shaped like \u003ccode\u003eRecord\u0026lt;string, T\u0026gt;\u003c/code\u003e. The affected code resides primarily in \u003ccode\u003esrc/query-compiler/default-query-compiler.ts\u003c/code\u003e and \u003ccode\u003esrc/query-builder/json-path-builder.ts\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a Kysely-based application that uses \u003ccode\u003eeb.ref(col, '-\u0026gt;$').key(input)\u003c/code\u003e or \u003ccode\u003e.at(input)\u003c/code\u003e to construct JSON path queries.\u003c/li\u003e\n\u003cli\u003eThe application\u0026rsquo;s JSON column is typed as \u003ccode\u003eRecord\u0026lt;string, T\u0026gt;\u003c/code\u003e, which allows attacker-controlled input to be passed to \u003ccode\u003e.key()\u003c/code\u003e without triggering type errors.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious input string containing JSON-path metacharacters (e.g., \u003ccode\u003enick.secret_field\u003c/code\u003e, \u003ccode\u003e*\u003c/code\u003e, \u003ccode\u003e[].secret]\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker-controlled input is passed to the \u003ccode\u003ekey()\u003c/code\u003e or \u003ccode\u003eat()\u003c/code\u003e function, which constructs a JSON path expression.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003evisitJSONPathLeg\u003c/code\u003e function in \u003ccode\u003edefault-query-compiler.ts\u003c/code\u003e is called to compile the JSON path.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esanitizeStringLiteral\u003c/code\u003e function is called on the attacker-controlled input, but it only escapes single quotes and does not neutralize other JSON-path metacharacters.\u003c/li\u003e\n\u003cli\u003eThe compiled SQL query, containing the unescaped metacharacters, is executed against the database.\u003c/li\u003e\n\u003cli\u003eThe database interprets the metacharacters as JSON path operators, allowing the attacker to access or modify unintended JSON sub-fields, leading to data disclosure or unauthorized modification of data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability can lead to unauthorized access to sensitive data stored within JSON columns, including SSNs, tokens, and admin flags. In MySQL and PostgreSQL, attackers can use wildcards to enumerate all values at the current depth or recursively across the entire document. In update statements, attackers can modify nested fields, potentially escalating privileges or altering application behavior. The vulnerability bypasses previous hardening attempts, making applications that relied on the earlier fix vulnerable again. The impact is significant for applications that handle sensitive data in JSON format and expose JSON path queries to user input.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply a dedicated \u003ccode\u003esanitizeJSONPathLeg\u003c/code\u003e function that only emits a known-good character set per leg type and rejects everything else as described in the advisory.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect Kysely JSON-path Injection Attempts\u0026rdquo; to monitor for attempted exploitation by detecting path traversal metacharacters.\u003c/li\u003e\n\u003cli\u003eAudit all code that uses \u003ccode\u003eeb.ref(col, '-\u0026gt;$').key(input)\u003c/code\u003e or \u003ccode\u003e.at(input)\u003c/code\u003e to ensure that user-supplied input is properly validated and sanitized.\u003c/li\u003e\n\u003cli\u003eUpgrade to Kysely version 0.28.17 (or later) once it is released to incorporate the necessary security fixes.\u003c/li\u003e\n\u003cli\u003eReview database logs for suspicious JSON path queries containing unexpected metacharacters (e.g. \u003ccode\u003e.\u003c/code\u003e \u003ccode\u003e*\u003c/code\u003e \u003ccode\u003e[]\u003c/code\u003e) targeting JSON columns to identify potential exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-11T19:42:38Z","date_published":"2026-05-11T19:42:38Z","id":"https://feed.craftedsignal.io/briefs/2026-05-kysely-jsonpath-injection/","summary":"A JSON-path traversal injection vulnerability exists in Kysely versions prior to 0.28.16, allowing attackers to traverse JSON sub-fields outside the intended scope, potentially leading to unauthorized read and write access to sensitive data in MySQL, PostgreSQL, and SQLite databases due to insufficient sanitization of JSON-path metacharacters in the `JSONPathBuilder.key()` and `.at()` functions.","title":"Kysely JSON-path Injection Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-05-kysely-jsonpath-injection/"}],"language":"en","title":"CraftedSignal Threat Feed — Cpe:2.3:a:kysely:kysely:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}