CVE-2026-32763: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32763 is a SQL injection vulnerability in the Kysely TypeScript SQL query builder affecting its JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key() and .at() directly into single-quoted JSON path string literals without escaping single quotes, allowing attackers to break out of the JSON path string context and inject arbitrary SQL. Affected versions are 0.26.0 through 0.28.11 (inclusive) for the npm kysely package; PostgreSQL dialect is not affected. The vulnerability was published on March 16, 2026, and carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Kysely Security Advisory).

The root cause (CWE-89: SQL Injection) lies in the visitJSONPathLeg() function within default-query-compiler.js, which calls this.append(String(node.value)) with no sanitization when constructing single-quoted JSON path strings (e.g., '$.key'). This is inconsistent with sanitizeIdentifier(), which properly doubles delimiter characters for SQL identifiers — both are non-parameterizable constructs requiring manual escaping, but only identifiers are protected. The vulnerability is dialect-specific: MySQL and SQLite use the ->$/->>$ operators, which route through JSONPathNode → visitJSONPathLeg() (vulnerable path), while PostgreSQL uses ->>/-> operators that route through appendStringLiteral() → sanitizeStringLiteral() (safe path). Exploitation requires that user-controlled input reaches .key() or .at() calls — a common pattern in dynamic JSON field selection APIs, GraphQL resolvers, and admin panels. A full end-to-end UNION-based PoC is publicly available in the security advisory (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to inject arbitrary SQL commands, enabling UNION-based data exfiltration from any table in the database — including sensitive tables not directly queried by the application (e.g., credential stores, admin tables). The primary impact is high confidentiality loss (full database read access) and low integrity impact (potential data modification depending on database permissions). Availability is not directly impacted, but lateral movement within the database tier is possible if the database user has elevated privileges (GitHub Advisory).

A complete, runnable JavaScript proof-of-concept demonstrating UNION-based data exfiltration against a real SQLite database is publicly available in the GitHub Security Advisory (Kysely Security Advisory). The vulnerability requires no authentication and no user interaction, and has low attack complexity — any application that passes unsanitized user input to .key() or .at() in MySQL or SQLite dialect contexts is exploitable over the network. The EPSS score is approximately 0.033% (6th percentile), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of this report. Qualys scanners have detection signatures for this vulnerability (detection IDs: 5009339, 6635593, 6635188) (Feedly).

1. Identify vulnerable applications: Search for Node.js applications using Kysely versions 0.26.0–0.28.11 with MySQL or SQLite dialects that expose endpoints accepting user-controlled JSON field names (e.g., query parameters like ?field=city passed to .key()).
2. Confirm the injection point: Send a benign request to the target endpoint (e.g., GET /api/products?field=name) and observe a normal JSON response, confirming the field parameter is used in a Kysely JSON path query.
3. Craft the injection payload: Construct a payload that closes the JSON path string context, completes the first SELECT column list, and appends a UNION query. Example payload for .key(): city' as "city" from "users" UNION SELECT password FROM admin --
4. Send the malicious request: Submit the payload via the vulnerable parameter: GET /api/products?field=city'%20as%20%22city%22%20from%20%22users%22%20UNION%20SELECT%20password%20FROM%20admin%20--%20
5. Observe exfiltrated data: The generated SQL becomes: select "profile"->>'$.city' as "city" from "users" UNION SELECT password FROM admin -- ' as "city" from "users" — the response will include rows from the injected admin table alongside normal results.
6. Enumerate further: Adapt the UNION payload to target other tables, extract schema information, or (if database permissions allow) modify data (GitHub Advisory, Kysely Security Advisory).

• Network: Unexpected HTTP requests containing single quotes ('), SQL keywords (UNION, SELECT, FROM, --), or encoded equivalents in query parameters that map to JSON field selectors (e.g., ?field=, ?key=).
• Logs: Application or web server access logs showing requests with URL-encoded SQL syntax (%27, %20UNION%20, %20SELECT%20) in parameters used for JSON path operations; database query logs (if enabled) showing unexpected UNION SELECT statements in queries involving JSON path operators (->>$, ->$).
• Database: Unusual query patterns in MySQL general query log or SQLite query tracing showing UNION SELECT appended to JSON path queries; queries accessing tables not normally referenced by the application.
• Application: Unexpected data appearing in API responses (e.g., rows from unrelated tables, credential values mixed with normal JSON field data) (GitHub Advisory).

Upgrade Kysely to version 0.28.12 or later, which fixes the issue by passing string values through sanitizeStringLiteral() in visitJSONPathLeg() before appending them to the JSON path string (Kysely Release, Fix Commit). If an immediate upgrade is not possible, implement application-level input validation to reject single quotes and SQL metacharacters in any values passed to .key() or .at() methods, and avoid passing unsanitized user-controlled input to these methods. Applications using only the PostgreSQL dialect are not affected and do not require immediate action (GitHub Advisory).

The vulnerability was reported by security researcher EthanKim88 and remediated by Kysely maintainer igalklebanov, who published the advisory and patch on March 16, 2026. The fix was included in the v0.28.12 release alongside other bug fixes, with the release notes explicitly calling out the injectable JSON path issue (Kysely Release). The advisory was picked up by multiple vulnerability tracking platforms including GitLab Advisories, INCIBE-CERT, and VulDB shortly after disclosure, indicating moderate community awareness (Feedly).