CVE-2026-33442 - Vulnerability Analysis

Overview

Kysely 0.28.12 and 0.28.13 contain a SQL injection caused by improper escaping of backslashes in sanitizeStringLiteral method, letting attackers inject arbitrary SQL on MySQL with default BACKSLASH_ESCAPES mode, exploit requires crafted input.

Severity & Score

Impact

Attackers can inject arbitrary SQL commands, potentially leading to data compromise or full database control.

Mitigation

Upgrade to version 0.28.14 or later.

References

• https://github.com/kysely-org/kysely/security/advisories/GHSA-fr9j-6mvq-frcv

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 26, 2026

🟠 CVE-2026-33442 - High (8.1) Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely's query compiler escapes single quotes (`'` → `''`) but does not escape backslashes. On MySQL with the default `BAC... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33442/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner