kysely-org/kysely Security Advisories | GitStock

high2026-05-11

Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

GHSA-pv5w-4p9q-p3v2 · CVE-2026-44635

high2026-03-20

Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings

GHSA-8cpq-38p9-67gx · CVE-2026-33468

high2026-03-20

Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.

GHSA-fr9j-6mvq-frcv · CVE-2026-33442

high2026-03-18

SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

GHSA-wmrf-hv6w-mr66 · CVE-2026-32763