Kysely is a type‑safe TypeScript SQL query builder. In versions up to and including 0.28.11 a SQL injection flaw exists in the handling of JSON path keys for the MySQL and SQLite dialects. The function visitJSONPathLeg() appends values supplied via .key() or .at() directly into single‑quoted JSON path string literals such as '$.key' without escaping single quotes. This allows an attacker to terminate the JSON path string and inject arbitrary SQL statements, potentially leading to data exfiltration, modification, or deletion.

Systems affected are applications that use the Kysely library (kysely‑org:kysely) with the MySQL or SQLite dialects, and which provide user input to the .key() or .at() methods. Any installation of Kysely with version 0.28.11 or earlier is vulnerable. The issue is mitigated in version 0.28.12 and later.

The vulnerability has a CVSS score of 8.2, indicating high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that an attacker can supply malicious JSON path keys and that the application does not enforce strict error handling or use parameterized queries for this code path. The lack of public exploit evidence does not diminish the risk, given the simplicity of the injection path and the potential impact on data integrity and confidentiality.