Kysely-org vulnerabilities
We track 4 vulnerabilities in Kysely-org products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 27, 2026.
Latest Kysely-org vulnerabilities
- 7.5 High severity
kysely: Improper Limitation of a Pathname to a Restricted Directory
Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (., [, ], *, **, ?). When attacker-controlled input flows into eb.ref(col, '->$').key(input) or .at(input
- 8.1 High severity
kysely: Improper Neutralization of Special Elements used in an SQL Command
Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (wh
- 8.1 High severity
kysely: Improper Neutralization of Special Elements used in an SQL Command
Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely's query compiler escapes single quotes (`'` → `''`) but does not escape backslashes. On MySQL with the default `BACKSLASH_ESCAPES`
- 8.2 High severity
kysely: Improper Neutralization of Special Elements used in an SQL Command
Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` an