https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 13:38:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276804 EUVD-2026-276804 https://cve.radiocsirt.org/vuln/euvd-2026-276804 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32763 <p>Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals (`&#39;$.key&#39;`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with `sanitizeIdentifier()`, which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Version 0.28.12 fixes the issue.</p> <p>Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals (`&#39;$.key&#39;`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with `sanitizeIdentifier()`, which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Version 0.28.12 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32763 https://cve.radiocsirt.org/vuln/ghsa-wmrf-hv6w-mr66 <p><strong>Affected:</strong> npm: kysely</p> <p>### Summary</p> <p>Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals (`&#39;$.key&#39;`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL.</p> <p>This is inconsistent with `sanitizeIdentifier()`, which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected.</p> <p>### Details</p> <p>`visitJSONPath()` wraps JSON path in single quotes (`&#39;$...&#39;`), and `visitJSONPathLeg()` appends each key/index value via `this.append(String(node.value))` with no sanitization:</p> <p>```javascript // dist/cjs/query-compiler/default-query-compiler.js visitJSONPath(node) { if (node.inOperator) { this.visitNode(node.inOperator); } this.append(&#34;&#39;$&#34;); for (const pathLeg of node.pathLegs) { this.visitNode(pathLeg); // Each leg appended without escaping } this.append(&#34;&#39;&#34;); } visitJSONPathLeg(node) { const isArrayLocation = node.type === &#39;ArrayLocation&#39;; this.append(isArrayLocation ? &#39;[&#39; : &#39;.&#39;); this.append(String(node.value)); // &lt;-- NO single quote escaping if (isArrayLocation) { this.append(&#39;]&#39;); } } ```</p> <p>Contrast with `sanitizeIdentifier()` in the same file, which properly doubles delim…</p> <p><strong>Affected:</strong> npm: kysely</p> <p>### Summary</p> <p>Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals (`&#39;$.key&#39;`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL.</p> <p>This is inconsistent with `sanitizeIdentifier()`, which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected.</p> <p>### Details</p> <p>`visitJSONPath()` wraps JSON path in single quotes (`&#39;$...&#39;`), and `visitJSONPathLeg()` appends each key/index value via `this.append(String(node.value))` with no sanitization:</p> <p>```javascript // dist/cjs/query-compiler/default-query-compiler.js visitJSONPath(node) { if (node.inOperator) { this.visitNode(node.inOperator); } this.append(&#34;&#39;$&#34;); for (const pathLeg of node.pathLegs) { this.visitNode(pathLeg); // Each leg appended without escaping } this.append(&#34;&#39;&#34;); } visitJSONPathLeg(node) { const isArrayLocation = node.type === &#39;ArrayLocation&#39;; this.append(isArrayLocation ? &#39;[&#39; : &#39;.&#39;); this.append(String(node.value)); // &lt;-- NO single quote escaping if (isArrayLocation) { this.append(&#39;]&#39;); } } ```</p> <p>Contrast with `sanitizeIdentifier()` in the same file, which properly doubles delim…</p> https://cve.radiocsirt.org/vuln/ghsa-wmrf-hv6w-mr66