CVE-2026-44635: Kysely JSON-path traversal injection in DefaultQueryCompiler

CVE-2026-44635 · Severity: high · CVSS 7.5 · Published 2026-05-27

Kysely, a popular TypeScript SQL query builder, is vulnerable to an injection flaw when handling JSON data. An attacker can provide specially crafted input to bypass intended data boundaries, allowing them to read or modify sensitive information stored in nested JSON fields that should be inaccessible. This could lead to the exposure of private user data, such as tokens or internal identifiers, and in some cases, allow unauthorized changes to database records.

Technologies: kysely (npm). Vendors: npm.

Quick answers

Is CVE-2026-44635 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44635 being exploited in the wild.
How severe is CVE-2026-44635?
High severity, with a CVSS score of 7.5, published 27 May 2026.
Which products and versions are affected?
kysely (npm) >= 0.26.0, < 0.28.17, SEMVER:introduced=0.26.0,fixed=0.28.17.
Is there a fix for CVE-2026-44635?
Yes. kysely (npm): upgrade to 0.28.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44635 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44635?
Check whether you run kysely (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • kysely (npm): upgrade to 0.28.17 or later
    npm install kysely@0.28.17

Technical details

A vulnerability exists in Kysely's JSON path building logic where the `DefaultQueryCompiler.visitJSONPathLeg` method fails to sanitize JSON-path metacharacters such as `.`, `[`, `]`, `*`, and `?`. While a previous fix addressed single-quote escaping, these metacharacters allow an attacker to break out of the intended JSON path leg. If an application passes user-controlled strings into `.key()` or `.at()`, an attacker can traverse into sibling or child fields (e.g., using `internal.admin` to reach a nested property). This affects MySQL, PostgreSQL (using `->$`), and SQLite dialects. The vulnerability is present even in type-safe code when JSON columns are typed as `Record<string, T>`. A patch is available in version 0.28.17.

Affected products

  • kysely-org kysely >= 0.26.0, < 0.28.17

Identifiers

  • CVE-2026-44635
  • GHSA-pv5w-4p9q-p3v2

Timeline

  • 2026-05-07: advisory: GitHub Advisory published
  • 2026-05-11: disclosed: CVE-2026-44635 assigned
  • 2026-05-07: patched: Fixed in version 0.28.17

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.