Kysely — CraftedSignal Threat Feed

Kysely SQL Injection Vulnerability (CVE-2026-33468)

hello@craftedsignal.io — Thu, 26 Mar 2026 17:16:41 +0000

Kysely, a type-safe TypeScript SQL query builder, is susceptible to a SQL injection vulnerability in versions prior to 0.28.14. The vulnerability, identified as CVE-2026-33468, stems from the DefaultQueryCompiler.sanitizeStringLiteral() function’s failure to properly escape backslashes. This incomplete sanitization, in conjunction with the MySQL dialect’s default setting where NO_BACKSLASH_ESCAPES is OFF, enables attackers to bypass string literal contexts by injecting arbitrary SQL…

SQL Injection Vulnerability in Kysely TypeScript Library (CVE-2026-33442)

hello@craftedsignal.io — Thu, 26 Mar 2026 17:16:40 +0000

Kysely, a type-safe TypeScript SQL query builder, is susceptible to a SQL injection vulnerability identified as CVE-2026-33442. The vulnerability resides in the sanitizeStringLiteral method of the query compiler within versions 0.28.12 and 0.28.13. The method inadequately handles backslashes, failing to escape them, while properly escaping single quotes. On MySQL servers configured with the default BACKSLASH_ESCAPES SQL mode enabled, this oversight allows an attacker to inject a backslash…