8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32763

CVE-2026-32763: SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key() and .at() directly into single-quoted JSON path string literals ('$.key') without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with sanitizeIdentifier(), which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Version 0.28.12 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32763

CVE-2026-32763:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
kysely	npm	>= 0.26.0, < 0.28.11	0.28.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic SQL injection flaw within the kysely query builder library, specifically affecting the MySQL and SQLite dialects when constructing JSON path queries. The analysis of the security advisory and the associated patch commit (0a602bff2f442f6c26d5e047ca8f8715179f6d24) points directly to the visitJSONPathLeg method in the DefaultQueryCompiler class as the source of the vulnerability. The advisory explicitly mentions that this function appends user-controlled values without escaping, and the patch confirms this by replacing the direct append operation (this.append(String(node.value))) with a conditional sanitization (this.sanitizeStringLiteral(node.value)). This function is called when building a query that uses JSON path accessors like .key() or .at(). An attacker can supply a malicious string to these methods, which is then processed by visitJSONPathLeg, leading to the injection. Therefore, any runtime profile during an exploit of this vulnerability would show DefaultQueryCompiler.visitJSONPathLeg in the stack trace as it processes the malicious input.

Vulnerable functions

DefaultQueryCompiler.visitJSONPathLeg

src/query-compiler/default-query-compiler.ts

The function `visitJSONPathLeg` in the `DefaultQueryCompiler` class was vulnerable to SQL injection. It directly appended the `node.value` to the SQL query without any sanitization. This allowed an attacker to inject arbitrary SQL by crafting a malicious string for a JSON path key, which would then be passed to this function. The patch fixes this by using `sanitizeStringLiteral` to escape the value if it's a string.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.