CVE-2026-32763

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals (`'$.key'`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with `sanitizeIdentifier()`, which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Version 0.28.12 fixes the issue.

• CWE-89

• https://github.com/kysely-org/kysely/commit/0a602bff2f442f6c26d5e047ca8f8715179f6d24Patch
• https://github.com/kysely-org/kysely/releases/tag/v0.28.12Release Notes
• https://github.com/kysely-org/kysely/security/advisories/GHSA-wmrf-hv6w-mr66Exploit, Mitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32758File Browser is a file managing interface for uploading, del…6.5
• CVE-2026-32759File Browser is a file managing interface for uploading, del…8.1
• CVE-2026-3276unicodedata.normalize() can take excessive CPU time when pro…6.3
• CVE-2026-32760File Browser is a file managing interface for uploading, del…9.8
• CVE-2026-32761File Browser is a file managing interface for uploading, del…6.5
• CVE-2026-32762Rack is a modular Ruby web server interface. From versions 3…6.5
• CVE-2026-32764Rejected reason: This repository is no longer public.
• CVE-2026-32765Rejected reason: This repository is no longer public.
• CVE-2026-32766astral-tokio-tar is a tar archive reading/writing library fo…5.3
• CVE-2026-32767SiYuan is a personal knowledge management system. Versions 3…9.8
• CVE-2026-32768Chall-Manager is a platform-agnostic system able to start Ch…9.9
• CVE-2026-32769Fullchain is an umbrella project for deploying a ready-to-us…9.8