CVE-2026-33442 describes a SQL injection vulnerability in Kysely, a TypeScript SQL query builder, affecting versions 0.28.12 and 0.28.13. The flaw lies in the `sanitizeStringLiteral` method, which fails to properly escape backslashes on MySQL when the default `BACKSLASH_ESCAPES` SQL mode is active. This allows an unauthenticated attacker to bypass string literal escaping and inject arbitrary SQL, leading to a high-severity impact (CVSS 8.1) with potential for full compromise of confidentiality, integrity, and availability, though the attack complexity is rated as high. Currently, there is no evidence of active exploitation, nor are there public exploit modules in Metasploit, Nuclei, or ExploitDB, and it is not listed in CISA's KEV catalog. However, the vulnerability has received some community attention, with mentions on platforms like Bluesky and Mastodon.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.28.12, < 0.28.14CPE matchmatch criteria | cpe:2.3:a:kysely:kysely:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.