CVE-2026-44635: Kysely JSON-path traversal injection in DefaultQueryCompiler

Executive brief

Kysely, a popular TypeScript SQL query builder, is vulnerable to an injection flaw when handling JSON data. An attacker can provide specially crafted input to bypass intended data boundaries, allowing them to read or modify sensitive information stored in nested JSON fields that should be inaccessible. This could lead to the exposure of private user data, such as tokens or internal identifiers, and in some cases, allow unauthorized changes to database records.

Technical details

A vulnerability exists in Kysely's JSON path building logic where the `DefaultQueryCompiler.visitJSONPathLeg` method fails to sanitize JSON-path metacharacters such as `.`, `[`, `]`, `*`, and `?`. While a previous fix addressed single-quote escaping, these metacharacters allow an attacker to break out of the intended JSON path leg. If an application passes user-controlled strings into `.key()` or `.at()`, an attacker can traverse into sibling or child fields (e.g., using `internal.admin` to reach a nested property). This affects MySQL, PostgreSQL (using `-> ), and SQLite dialects. The vulnerability is present even in type-safe code when JSON columns are typed as `Record<string, T>`. A patch is available in version 0.28.17.

Affected products

• kysely-org kysely >= 0.26.0, < 0.28.17

Timeline

• 2026-05-07: advisory: GitHub Advisory published
• 2026-05-11: disclosed: CVE-2026-44635 assigned
• 2026-05-07: patched: Fixed in version 0.28.17

References

• https://api.github.com/users/StarPlatinu
• https://github.com/StarPlatinu
• https://api.github.com/users/StarPlatinu/gists%7B/gist_id%7D
• https://api.github.com/users/StarPlatinu/repos
• https://avatars.githubusercontent.com/u/72287279?v=4
• https://api.github.com/users/StarPlatinu/events%7B/privacy%7D