Kysely is a type‑safe TypeScript SQL query builder. Prior to version 0.28.14 the sanitation routine for string literals only doubled single quotes but left backslashes untouched. In MySQL, where NO_BACKSLASH_ESCAPES is OFF by default, an attacker can inject a backslash to terminate the string literal, break out of the string context, and execute arbitrary SQL. This control flow is reachable through any code path that uses the ImmediateValueTransformer, such as CreateIndexBuilder.where() or CreateViewBuilder.as(). The vulnerability permits the attacker to inject malicious SQL statements, compromising the confidentiality, integrity, and availability of the database.

The flaw affects all projects that use the kysely library before version 0.28.14. Any Node.js application that imports this library, targets a MySQL database, and inline values in query builder methods is potentially vulnerable. The vendor identified is kysely-org, and the affected product is the Kysely library. The fix is delivered in release 0.28.14.

The CVSS score of 8.1 indicates high severity, yet the EPSS score is below 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the application accepts unsanitized user input that is inlined into SQL queries and that the MySQL connection uses the default backslash escaping. Without updating to v0.28.14, the risk remains legitimate.