EUVD-2026-277675

fkie_cve-2026-33468

Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`. Version 0.28.14 contains a fix.

GHSA-8cpq-38p9-67gx — Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that…

Affected: npm: kysely

## Summary

Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`.

## Details

The root cause is in `DefaultQueryCompiler.sanitizeStringLiteral()`:

**`src/query-compiler/default-query-compiler.ts:1819-1821`** ```typescript protected sanitizeStringLiteral(value: string): string { return value.replace(LIT_WRAP_REGEX, "''") } ```

Where `LIT_WRAP_REGEX` is defined as `/'/g` (line 121). This only doubles single quotes — it does not escape backslash characters.

The function is called from `appendStringLiteral()` which wraps the sanitized value in single quotes:

**`src/query-compiler/default-query-compiler.ts:1841-1845`** ```typescript protected appendStringLiteral(value: string): void { this.append("'") this.append(this.sanitizeStringLiteral(value)) this.append("'") } ```

This is reached when `visitValue()` encounters an immediate value node (line 525-527), which is created by `ImmediateValueTransformer` used in `CreateIndexBuilder.where()`:

**`src/schema/create-index-builder.ts:266-278`** ```typesc…

Most recent entries from all

EUVD-2026-277675

fkie_cve-2026-33468

GHSA-8cpq-38p9-67gx — Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that…