Kysely is a type‑safe TypeScript SQL query builder. In versions up to and including 0.28.11, the JSON path compiler for MySQL and SQLite concatenates user‑controlled values supplied via the .key() and .at() methods directly into single‑quoted JSON path string literals without escaping single quotes. This omission permits an attacker to terminate the JSON path string and injected malicious SQL into the query. The flaw is a classic SQL Injection (CWE‑89) that can allow an attacker to read, modify or delete data in the database, thereby compromising confidentiality, integrity, and availability of the application’s data.

Any Node.js application that imports the kysely-org/kysely library and uses the .key() or .at() methods to build JSON path expressions against MySQL or SQLite is affected. All releases up to 0.28.11 are vulnerable; the fix is included in release 0.28.12 and later.

The vulnerability carries a high severity with a CVSS score of 8.2. Its EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation for the time being. However, the attack vector is straightforward: an attacker who can influence data passed to .key() or .at() can inject arbitrary SQL. This can provide the same level of access as the application, potentially leading to data exfiltration or modification.