CVE-2026-33468: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33468 is a SQL injection vulnerability in the Kysely TypeScript SQL query builder library, specifically affecting the CreateIndexBuilder.where() and CreateViewBuilder.as() methods when using the MySQL dialect. The root cause is that DefaultQueryCompiler.sanitizeStringLiteral() escapes single quotes but fails to escape backslash characters, allowing attackers to break out of string literals in MySQL environments where NO_BACKSLASH_ESCAPES is OFF (the default). All Kysely npm versions up to and including 0.28.13 are affected; version 0.28.14 contains the fix. It carries a CVSS v3.1 base score of 8.1 (High) (Github Advisory, Kysely Advisory).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The flaw resides in DefaultQueryCompiler.sanitizeStringLiteral() (default-query-compiler.ts:1819-1821), which only replaces single quotes with doubled quotes (' → '') via the regex /'/g, but does not escape backslash characters. When appendStringLiteral() wraps the sanitized value in single quotes, a user-supplied input like \' OR 1=1 -- causes MySQL to interpret \' as an escaped literal quote, allowing the second ' to close the string and the remainder to be parsed as SQL. The MysqlQueryCompiler class extends DefaultQueryCompiler without overriding sanitizeStringLiteral, inheriting the vulnerable behavior. This code path is triggered via ImmediateValueTransformer, which is used by both CreateIndexBuilder.where() and CreateViewBuilder.as() to inline values directly into DDL statements (Github Advisory, Kysely Advisory).

Successful exploitation allows an attacker who controls values passed to the affected DDL builder methods to execute arbitrary SQL against the MySQL database. This enables data exfiltration via UNION-based or subquery-based techniques, data modification or destruction through stacked queries or subqueries, and potential authentication bypass if index creation or view definitions are influenced by user-controlled input in application logic. The impact is rated High across confidentiality, integrity, and availability (Github Advisory).

A proof-of-concept exploit with concrete reproduction steps — including a specific malicious TypeScript payload, compiled SQL output, and live MySQL setup instructions — is publicly available in the official security advisory (Kysely Advisory). The EPSS score is approximately 0.034% (0.000480), indicating a low current probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog. Attack complexity is rated High because exploitation requires an application to pass untrusted user input into DDL schema builder methods, which is an atypical usage pattern (Github Advisory).

1. Identify target application: Locate a Node.js application using Kysely ≤ 0.28.13 with the MySQL dialect where user-controlled input is passed to CreateIndexBuilder.where() or CreateViewBuilder.as().
2. Craft malicious payload: Prepare a backslash-based injection string such as \' OR 1=1 -- as the value to be passed to the vulnerable method.
3. Trigger the vulnerable code path: Submit the payload through the application's interface (e.g., an API endpoint or form field) that routes user input into the DDL builder method.
4. Observe SQL injection: Kysely's sanitizeStringLiteral() doubles the single quote but leaves the backslash unescaped, producing SQL like: WHERE \status` = ''' OR 1=1 --'. MySQL interprets 'as an escaped literal quote, causingOR 1=1` to be evaluated as SQL.
5. Exploit for data access: Extend the payload with UNION-based queries (e.g., \' UNION SELECT table_name,2,3 FROM information_schema.tables -- ) to exfiltrate data, or use subqueries to modify or delete records.
6. Verify results: Confirm injection success by observing that the query returns all rows (bypassing the WHERE filter) or returns data from other tables (Kysely Advisory).

• Logs: Application or database query logs containing SQL strings with patterns like = '\'' or OR 1=1 -- in DDL statements (CREATE INDEX, CREATE VIEW); unexpected UNION SELECT or subquery constructs in index/view creation queries.
• Network: Unusual or repeated API requests containing backslash-quote sequences (\') in parameters that are used for schema operations.
• Database: Unexpected database views or indexes created with anomalous WHERE conditions; unauthorized data reads from sensitive tables not normally accessed by the application's schema management logic.
• Process/Application: Node.js application errors or stack traces related to MySQL query parsing failures, which may indicate failed injection attempts (Kysely Advisory).

Upgrade Kysely to version 0.28.14 or later, which fixes the issue by overriding sanitizeStringLiteral in MysqlQueryCompiler to escape backslashes before doubling single quotes (\ → \\, then ' → ''). As an immediate workaround, do not pass untrusted user input directly to CreateIndexBuilder.where() or CreateViewBuilder.as(). Additionally, enabling NO_BACKSLASH_ESCAPES mode in MySQL removes the backslash escape behavior and mitigates the injection vector, though upgrading the library remains the recommended fix. Review all application code for instances where user-controlled data reaches DDL schema builder methods and refactor to use safe alternatives or strict input validation (Github Advisory, Kysely Advisory).

The vulnerability was reported by researcher igalklebanov and published by the Kysely maintainers on March 20, 2026. Social media activity was observed on Bluesky and Mastodon shortly after disclosure, with automated CVE tracking accounts sharing the advisory. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregator coverage (Kysely Advisory).