Quick answers
- Is CVE-2026-33442 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-33442 being exploited in the wild.
- How severe is CVE-2026-33442?
- Low severity, with a CVSS score of 3.1, published 20 March 2026.
- Which products and versions are affected?
- kysely (npm) SEMVER:introduced=0.28.12,fixed=0.28.14.
- Is there a fix for CVE-2026-33442?
- Yes. kysely (npm): upgrade to 0.28.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-33442 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-33442?
- Check whether you run kysely (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- kysely (npm): upgrade to 0.28.14 or later
npm install kysely@0.28.14
Technical details
The vulnerability is a SQL injection flaw in the sanitizeStringLiteral() method within Kysely's query compiler. When building JSON path expressions (e.g., via .key() or .at() methods), user input is wrapped in single quotes but the compiler only escapes single quotes by doubling them—it does not escape backslashes. On MySQL with the default BACKSLASH_ESCAPES mode, an attacker can inject a backslash before a single quote (e.g., \' OR 1=1) to break out of the string literal and inject arbitrary SQL. The attack requires non-type-safe usage of JSON path builder methods with user-controlled input, which is realistic in applications with dynamic JSON schema access. PostgreSQL and SQLite are unaffected. A patch is available in version 0.28.14 and later.
Affected products
- Kysely Kysely 0.28.12-0.28.13
Identifiers
- CVE-2026-33442
- GHSA-fr9j-6mvq-frcv
Timeline
- 2026-03-20: disclosed
- 2026-03-20: patched: Fix available in version 0.28.14 and later