Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 17:07:32 +0000 CVE-2026-33442 — Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. https://cve.radiocsirt.org/vuln/cve-2026-33442 <p><strong>Affected:</strong> kysely-org kysely</p> <p>Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely&#39;s query compiler escapes single quotes (`&#39;` → `&#39;&#39;`) but does not escape backslashes. On MySQL with the default `BACKSLASH_ESCAPES` SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL. Version 0.28.14 fixes the issue.</p> <p><strong>Affected:</strong> kysely-org kysely</p> <p>Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely&#39;s query compiler escapes single quotes (`&#39;` → `&#39;&#39;`) but does not escape backslashes. On MySQL with the default `BACKSLASH_ESCAPES` SQL mode, an attacker can inject a backslash before a single quote to neutralize the escaping, breaking out of the JSON path string literal and injecting arbitrary SQL. Version 0.28.14 fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-33442