Kysely, a type-safe TypeScript SQL query builder, contains an injection flaw where JSON‑path components supplied to JSONPathBuilder.key() or .at() are not escaped. Metacharacters such as dot, brackets and wildcards are interpreted literally, allowing an attacker to craft a JSON‑path string that traverses beyond the intended key. The flaw permits read access to hidden sibling or child fields and, in update statements, write access to any JSON sub‑field. This results in potential data exfiltration or tampering against the JSON payload stored in MySQL, PostgreSQL, or SQLite.

The vulnerability affects Kysely versions 0.26.0 through 0.28.16. The product is Kysely (kysely‑org:kysely). Any deployment using MySQL, PostgreSQL, or SQLite and that executes code paths that call eb.ref(col, '->$').key(input) or .at(input) with user‑controlled input is susceptible.

The CVSS score of 7.5 indicates a high severity level. EPSS information is not available, so the precise likelihood of exploitation is uncertain, but the vulnerability is not listed in the CISA KEV catalog and no publicly noted exploits exist. Attackers would need to influence the value passed to key() or .at(), typically by providing specially crafted input to an API endpoint that accepts JSON‑path values. Successful exploitation could grant read or write access to arbitrary JSON fields in the database.