CVE-2026-32763

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32763
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32763.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32763
Aliases
Related
Published
2026-03-19T23:14:58.747Z
Modified
2026-04-10T05:43:05.553363Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
Details

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key() and .at() directly into single-quoted JSON path string literals ('$.key') without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with sanitizeIdentifier(), which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Version 0.28.12 fixes the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32763.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ]
}
References

Affected packages

Git / github.com/kysely-org/kysely

Affected ranges

Type
GIT
Repo
https://github.com/kysely-org/kysely
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0a602bff2f442f6c26d5e047ca8f8715179f6d24
Type
GIT
Repo
https://github.com/kysely-org/kysely
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
afc81a1a11a139114b891abd654424fcd8b6afaa

Affected versions

0.*
0.10.0
0.10.1
0.11.0
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
0.12.1
0.12.2
0.13.0
0.14.0
0.14.1
0.15.0
0.15.1
0.15.2
0.15.3
0.16.0
0.16.1
0.16.10
0.16.11
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.16.7
0.16.8
0.16.9
0.17.0
0.17.2
0.17.3
0.18.0
0.18.1
0.19.0
0.19.1
0.19.10
0.19.11
0.19.12
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
0.20.0
0.20.1
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.22.0
0.23.0
0.23.1
0.23.2
0.23.3
0.23.4
0.23.5
0.24.0
0.24.2
0.25.0
0.26.0
0.26.1
0.26.2
0.26.3
0.27.0
0.27.1
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.28.0
0.28.1
0.28.2
0.7.8
0.7.9
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
v0.*
v0.28.10
v0.28.11
v0.28.3
v0.28.4
v0.28.5
v0.28.6
v0.28.7
v0.28.8
v0.28.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32763.json"