Security: kysely-org/kysely
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`GHSA-pv5w-4p9q-p3v2 published
May 7, 2026 by igalklebanovHigh -
MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.GHSA-fr9j-6mvq-frcv published
Mar 20, 2026 by igalklebanovHigh -
MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL stringsGHSA-8cpq-38p9-67gx published
Mar 20, 2026 by igalklebanovHigh -
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.GHSA-wmrf-hv6w-mr66 published
Mar 16, 2026 by igalklebanovHigh