https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T16:10:21.969889+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-277675 EUVD-2026-277675 2026-10-17T16:10:21.974248+00:00 EUVD-2026-277675 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33468 fkie_cve-2026-33468 2026-10-17T16:10:21.974282+00:00

Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`. Version 0.28.14 contains a fix.

 https://cve.radiocsirt.org/vuln/ghsa-8cpq-38p9-67gx GHSA-8cpq-38p9-67gx — Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that… 2026-10-17T16:10:21.974318+00:00

Affected: npm: kysely

## Summary

Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`.

## Details

The root cause is in `DefaultQueryCompiler.sanitizeStringLiteral()`:

**`src/query-compiler/default-query-compiler.ts:1819-1821`** ```typescript protected sanitizeStringLiteral(value: string): string { return value.replace(LIT_WRAP_REGEX, "''") } ```

Where `LIT_WRAP_REGEX` is defined as `/'/g` (line 121). This only doubles single quotes — it does not escape backslash characters.

The function is called from `appendStringLiteral()` which wraps the sanitized value in single quotes:

**`src/query-compiler/default-query-compiler.ts:1841-1845`** ```typescript protected appendStringLiteral(value: string): void { this.append("'") this.append(this.sanitizeStringLiteral(value)) this.append("'") } ```

This is reached when `visitValue()` encounters an immediate value node (line 525-527), which is created by `ImmediateValueTransformer` used in `CreateIndexBuilder.where()`:

**`src/schema/create-index-builder.ts:266-278`** ```typesc…