Quick answers
- Is CVE-2026-33468 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-33468 being exploited in the wild.
- How severe is CVE-2026-33468?
- Low severity, with a CVSS score of 3.1, published 20 March 2026.
- Which products and versions are affected?
- kysely (npm) SEMVER:introduced=0,fixed=0.28.14.
- Is there a fix for CVE-2026-33468?
- Yes. kysely (npm): upgrade to 0.28.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-33468 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-33468?
- Check whether you run kysely (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- kysely (npm): upgrade to 0.28.14 or later
npm install kysely@0.28.14
Technical details
The vulnerability is a SQL injection flaw in DefaultQueryCompiler.sanitizeStringLiteral(), which only escapes single quotes by doubling them but does not escape backslash characters. In MySQL with the default NO_BACKSLASH_ESCAPES=OFF setting, a backslash acts as an escape character inside string literals, allowing an attacker to escape the trailing quote and break out of the string context. The flaw affects code paths using ImmediateValueTransformer, specifically CreateIndexBuilder.where() and CreateViewBuilder.as(). An attacker who can control values passed to these methods can inject arbitrary SQL. The attack requires passing untrusted input to DDL schema builder methods, which is atypical but possible in some application architectures. The issue is patched in version 0.28.14 and later.
Affected products
- Kysely Kysely <=0.28.13
Identifiers
- CVE-2026-33468
- GHSA-8cpq-38p9-67gx
Timeline
- 2026-03-20: disclosed
- 2026-03-20: patched: Fixed in version 0.28.14