CVE-2026-33468 - Vulnerability Analysis

Overview

Kysely < 0.28.14 contains a SQL injection caused by improper escaping of backslashes in string literals in DefaultQueryCompiler.sanitizeStringLiteral(), letting attackers inject arbitrary SQL via ImmediateValueTransformer in MySQL dialect, exploit requires crafted input.

Severity & Score

Impact

Attackers can inject arbitrary SQL commands, potentially leading to data leakage, modification, or full database compromise.

Mitigation

Upgrade to version 0.28.14 or later.

References

• https://github.com/kysely-org/kysely/security/advisories/GHSA-8cpq-38p9-67gx

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 26, 2026

🟠 CVE-2026-33468 - High (8.1) Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the My... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33468/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner