CVE-2026-32763

Katalog CVE

CVSS 8.2 · High EPSS 0,41%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada kysely. Skor CVSS 3.1 8.2 (High) menurut github.com.

Deskripsi (NVD)

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals (`'$.key'`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with `sanitizeIdentifier()`, which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Version 0.28.12 fixes the issue.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kysely-org/kysely/security/advisories/GHSA-wmrf-hv6w-mr66 exploit · mitigasi · advisory vendor
• https://github.com/kysely-org/kysely/commit/0a602bff2f442f6c26d5e047ca8f8715179f6d24 patch
• https://github.com/kysely-org/kysely/releases/tag/v0.28.12 release notes