CVE-2026-32763
Published: 20 March 2026
Summary
CVE-2026-32763 is a high-severity SQL Injection (CWE-89) vulnerability in Kysely Kysely. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Kysely, a type-safe TypeScript SQL query builder, contains a SQL injection vulnerability (CWE-89) in versions up to and including 0.28.11. The issue affects JSON path compilation specifically for MySQL and SQLite dialects, where the `visitJSONPathLeg()` function directly appends user-controlled values from `.key()` and `.at()` into single-quoted JSON path string literals (e.g., `'$.key'`) without escaping single quotes. This allows attackers to break out of the string context and inject arbitrary SQL, unlike the properly escaped `sanitizeIdentifier()` function used for identifiers.
The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating it is exploitable remotely with low complexity and no privileges required. An attacker who can influence the arguments to `.key()` or `.at()` in a Kysely query—such as through untrusted user input in a web application—can craft payloads with unescaped single quotes to escape the JSON path string and execute arbitrary SQL. This enables high-impact confidentiality breaches, like data exfiltration, alongside limited integrity modifications.
Mitigation is available in Kysely version 0.28.12, which addresses the escaping inconsistency in `visitJSONPathLeg()`. Security practitioners should upgrade affected applications immediately, as detailed in the project's security advisory (GHSA-wmrf-hv6w-mr66), release notes for v0.28.12, and the fixing commit (0a602bff2f442f6c26d5e047ca8f8715179f6d24). Review and audit Kysely usage in MySQL/SQLite contexts for user-controlled JSON path inputs.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13392
Vulnerability details
Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into…
more
single-quoted JSON path string literals (`'$.key'`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with `sanitizeIdentifier()`, which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Version 0.28.12 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection (CWE-89) in a TypeScript query builder library used server-side for MySQL/SQLite; directly enables remote arbitrary SQL execution via untrusted input to .key()/.at() in public-facing web apps.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely identification, reporting, and correction of the SQL injection flaw through upgrading Kysely to the patched version 0.28.12.
Prevents exploitation of the SQL injection vulnerability by enforcing validation and sanitization of user-controlled inputs to Kysely's .key() and .at() methods prior to JSON path compilation.
Facilitates early detection of the CVE in Kysely dependencies through vulnerability scanning and monitoring of third-party software components.