CVE-2026-33468

Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`. Version 0.28.14 contains a fix.

• CWE-89

• https://github.com/kysely-org/kysely/security/advisories/GHSA-8cpq-38p9-67gxExploit, Mitigation, Vendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33461Incorrect Authorization (CWE-863) in Kibana can lead to info…6.5
• CVE-2026-33462A path traversal vulnerability was identified in Kibana's da…7.3
• CVE-2026-33463Operation on a Resource after Expiration or Termination (CWE…5.3
• CVE-2026-33464Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-33466Improper Limitation of a Pathname to a Restricted Directory …9.8
• CVE-2026-33467Improper Verification of Cryptographic Signature (CWE-347) i…5.9
• CVE-2026-33469Frigate is a network video recorder (NVR) with realtime loca…6.5
• CVE-2026-3347The Multi Functional Flexi Lightbox plugin for WordPress is …5.5
• CVE-2026-33470Frigate is a network video recorder (NVR) with realtime loca…4.3
• CVE-2026-33471nimiq-block contains block primitives to be used in Nimiq's …9.6
• CVE-2026-33472Cryptomator is an open-source client-side encryption applica…4.8
• CVE-2026-33473Vikunja is an open-source self-hosted task management platfo…5.7