7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44635

CVE-2026-44635: Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (., [, ], *, **, ?). When attacker-controlled input flows into eb.ref(col, '->$').key(input) or .at(input) — including type-safe code where the JSON column is shaped like Record<string, T> so K extends string is the inferred type — every dot becomes a path-leg separator, letting an attacker traverse from the intended key into sibling and child fields the developer never meant to expose. The result is read access (and, in update statements, write access) to JSON sub-fields outside the intended scope across MySQL, PostgreSQL ->$/->>$, and SQLite. This vulnerability is fixed in 0.28.17.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44635

CVE-2026-44635:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
kysely	npm	>= 0.26.0, < 0.28.17	0.28.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a JSON-path traversal injection in the Kysely query builder. It arises from insufficient sanitization of user-provided input used in constructing JSON paths for SQL queries. The core of the vulnerability lies in the visitJSONPathLeg function in default-query-compiler.ts, which builds the JSON path string. This function uses sanitizeStringLiteral for sanitization, but this function only escapes single quotes and fails to address other JSON path metacharacters like . or [.

An attacker can supply a specially crafted string to the .key() or .at() methods of the JSONPathBuilder. This input is then passed to visitJSONPathLeg without proper sanitization. For example, an input like "internal.secret" to the .key() method would result in a JSON path like $.internal.secret instead of the intended $."internal.secret". This allows the attacker to traverse into nested JSON objects and access or modify data that they are not supposed to, leading to an authorization bypass. The vulnerability affects MySQL, PostgreSQL, and SQLite dialects.

The fix involves introducing a new, stricter sanitization function, sanitizeJSONPathMemberValue, which properly quotes and escapes the JSON path segments, and adding input validation to the .at() method. This ensures that user input is treated as a single literal value rather than being interpreted as part of the JSON path structure.

Vulnerable functions

DefaultQueryCompiler.visitJSONPathLeg

src/query-compiler/default-query-compiler.ts

This function constructs the JSON path string for the SQL query. The original implementation did not properly sanitize the `node.value`, which can be controlled by an attacker. This allowed for path traversal characters (like '.') to be injected into the JSON path, leading to unauthorized access to nested JSON fields.

JSONPathBuilder.key

src/query-builder/json-path-builder.ts

This function is a primary entry point for user-controlled input that is used to build a JSON path. It takes a `key` and passes it to `#createBuilderWithPathLeg` without any sanitization. This `key` is then used by `visitJSONPathLeg` to construct the vulnerable JSON path.

JSONPathBuilder.at

src/query-builder/json-path-builder.ts

Similar to the `key` method, the `at` method is another entry point for user-controlled input for array access in a JSON path. The lack of input validation in the vulnerable version allowed an attacker to inject malicious characters and break out of the intended array index access.

DefaultQueryCompiler.sanitizeStringLiteral

src/query-compiler/default-query-compiler.ts

This function was used to sanitize the input for the JSON path, but it was insufficient as it only escaped single quotes. It did not handle other JSON path metacharacters like '.', '[', ']', '*', etc., which is the root cause of the path traversal vulnerability.

MysqlQueryCompiler.sanitizeStringLiteral

src/dialect/mysql/mysql-query-compiler.ts

This function is a dialect-specific override of `sanitizeStringLiteral`. While it adds backslash escaping, it still fails to sanitize JSON path metacharacters, making it vulnerable to the same path traversal injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.