CVE-2026-44635 in kysely
Summary
by MITRE • 05/27/2026
Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (., [, ], *, **, ?). When attacker-controlled input flows into eb.ref(col, '->$').key(input) or .at(input) — including type-safe code where the JSON column is shaped like Record so K extends string is the inferred type — every dot becomes a path-leg separator, letting an attacker traverse from the intended key into sibling and child fields the developer never meant to expose. The result is read access (and, in update statements, write access) to JSON sub-fields outside the intended scope across MySQL, PostgreSQL ->$/->>$, and SQLite. This vulnerability is fixed in 0.28.17.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/29/2026
The vulnerability in Kysely's DefaultQueryCompiler.visitJSONPathLeg affects versions 0.26.0 through 0.28.16 and represents a critical security flaw in the type-safe TypeScript SQL query builder's handling of JSON path expressions. This issue stems from insufficient escaping of JSON-path metacharacters including dots, brackets, asterisks, and question marks that are fundamental to JSON path navigation syntax. The flaw occurs specifically when attacker-controlled input flows into the eb.ref(col, '->$').key(input) or .at(input) methods, where the JSON column is typed as Record with K extends string, allowing the type system to infer string types for key references.
The technical implementation of this vulnerability exploits the inherent structure of JSON path navigation where dots serve as path-leg separators, enabling attackers to manipulate the intended traversal scope. When an attacker provides input containing these metacharacters, the query builder fails to properly escape them, allowing the JSON path expression to traverse unintended sibling and child fields. This creates a path traversal vulnerability that operates across multiple database systems including MySQL, PostgreSQL with ->$/->>$ operators, and SQLite, each of which implements JSON path semantics differently but all susceptible to this escaping deficiency.
The operational impact of this vulnerability extends beyond simple data exposure to potentially enable full read and write access to JSON sub-fields outside the developer's intended scope. In read operations, attackers can access sensitive data stored in adjacent JSON fields that were never meant to be exposed through the application's query interface. When used in update statements, the vulnerability becomes even more dangerous as it allows attackers to modify arbitrary JSON sub-fields, potentially compromising data integrity and enabling privilege escalation through unauthorized data modification. This vulnerability aligns with CWE-20: Improper Input Validation and represents a classic example of path traversal in database query construction.
The attack surface is particularly concerning given that this affects type-safe code where developers expect strong typing guarantees to prevent such injection attacks. The vulnerability demonstrates how even sophisticated type systems can be bypassed when underlying query construction methods fail to properly sanitize input. The fix implemented in version 0.28.17 addresses the core issue by ensuring proper escaping of JSON-path metacharacters during the compilation process, preventing attackers from manipulating the path traversal behavior. Organizations using Kysely in production environments should immediately upgrade to version 0.28.17 or later to mitigate this risk, as the vulnerability operates at the query generation level where input validation occurs before database execution, making it particularly dangerous for applications handling sensitive JSON data. This vulnerability also relates to ATT&CK techniques involving data manipulation and privilege escalation through injection attacks, emphasizing the need for comprehensive input sanitization in database query builders.