PT-2026-26762 · Kysely · Kysely
Offset
·
Published
2026-03-20
·
Updated
2026-03-26
·
CVE-2026-33468
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Kysely versions prior to 0.28.14
Description
Kysely's
DefaultQueryCompiler.sanitizeStringLiteral() function inadequately escapes backslashes when handling string literals. Specifically, it only doubles single quotes but does not address backslashes. When used with the MySQL dialect, where NO BACKSLASH ESCAPES is typically OFF, an attacker can leverage this to escape the closing quote of a string literal, enabling arbitrary SQL injection. This issue impacts code paths utilizing ImmediateValueTransformer for inline values, notably CreateIndexBuilder.where() and CreateViewBuilder.as(). The root cause lies in the sanitizeStringLiteral() function, which uses a regular expression that only targets single quotes. The function is called within appendStringLiteral(), which wraps the sanitized value in single quotes. The MysqlQueryCompiler inherits this behavior without overriding the sanitizeStringLiteral() function. An attacker can exploit this by crafting input containing backslashes to escape the closing quote, effectively injecting malicious SQL code. A proof-of-concept demonstrates how a crafted input can bypass the intended string literal context and execute arbitrary SQL commands, potentially leading to data exfiltration, modification, or authentication bypass.Recommendations
Versions prior to 0.28.14 should be updated to version 0.28.14 or later. The
MysqlQueryCompiler should override the sanitizeStringLiteral() function to escape backslashes before doubling single quotes. Specifically, the backslash character should be escaped as `` before doubling the single quotes.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kysely