Executive brief
Kysely is a TypeScript SQL query builder used by developers to safely construct database queries. The library contains a flaw in how it escapes special characters when building MySQL queries, allowing attackers who can control input to schema builder methods to inject arbitrary SQL commands. This could lead to unauthorized data access, modification, or deletion from the database.
Technical details
The vulnerability is a SQL injection flaw in DefaultQueryCompiler.sanitizeStringLiteral(), which only escapes single quotes by doubling them but does not escape backslash characters. In MySQL with the default NO_BACKSLASH_ESCAPES=OFF setting, a backslash acts as an escape character inside string literals, allowing an attacker to escape the trailing quote and break out of the string context. The flaw affects code paths using ImmediateValueTransformer, specifically CreateIndexBuilder.where() and CreateViewBuilder.as(). An attacker who can control values passed to these methods can inject arbitrary SQL. The attack requires passing untrusted input to DDL schema builder methods, which is atypical but possible in some application architectures. The issue is patched in version 0.28.14 and later.
Affected products
- Kysely Kysely <=0.28.13
Timeline
- 2026-03-20: disclosed
- 2026-03-20: patched: Fixed in version 0.28.14