https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 17:07:50 +0000 https://cve.radiocsirt.org/vuln/cve-2026-33468 <p><strong>Affected:</strong> kysely-org kysely</p> <p>Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely&#39;s `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`&#39;` → `&#39;&#39;`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`. Version 0.28.14 contains a fix.</p> <p><strong>Affected:</strong> kysely-org kysely</p> <p>Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely&#39;s `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`&#39;` → `&#39;&#39;`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`. Version 0.28.14 contains a fix.</p> https://cve.radiocsirt.org/vuln/cve-2026-33468