Executive brief
Kysely is a TypeScript SQL query builder used by developers to construct database queries safely. A vulnerability in versions 0.26.0 through 0.28.11 allows attackers to inject arbitrary SQL code through JSON path keys in MySQL and SQLite queries, enabling unauthorized data access or manipulation. This affects applications that pass user input directly to JSON path methods like .key() without additional validation.
Technical details
The vulnerability is a SQL injection in the visitJSONPathLeg() function of the query compiler. JSON path keys and array indices are appended directly into single-quoted SQL string literals without escaping single quotes, allowing an attacker to break out of the JSON path context. While the codebase includes a sanitizeIdentifier() function that properly doubles delimiters for SQL identifiers, the same protection is missing for JSON path values. PostgreSQL is unaffected because it uses a different code path (JSONOperatorChainNode) that reuses the existing sanitizeStringLiteral() function. The attack requires either type-checking to be disabled (Kysely<any>) or compilation errors to be silently ignored. Patch available in version 0.28.12 and later.
Affected products
- Kysely Kysely 0.26.0 through 0.28.11
Timeline
- 2026-03-18: disclosed: GHSA-wmrf-hv6w-mr66 published
- 2026-03-18: patched: Fixed in version 0.28.12