CVE-2026-44635

Full vulnerability record from the local CVENow database.

Description

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (., [, ], *, **, ?). When attacker-controlled input flows into eb.ref(col, '->$').key(input) or .at(input) — including type-safe code where the JSON column is shaped like Record<string, T> so K extends string is the inferred type — every dot becomes a path-leg separator, letting an attacker traverse from the intended key into sibling and child fields the developer never meant to expose. The result is read access (and, in update statements, write access) to JSON sub-fields outside the intended scope across MySQL, PostgreSQL ->$/->>$, and SQLite. This vulnerability is fixed in 0.28.17.

Severity

HIGH

CVSS score

7.5 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-05-27 19:16:20.947000

Last modified

2026-10-26 11:10:00.157000

View original CVE JSON

{
  "id": "CVE-2026-44635",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T19:16:20.947",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (., [, ], *, **, ?). When attacker-controlled input flows into eb.ref(col, '->$').key(input) or .at(input) — including type-safe code where the JSON column is shaped like Record<string, T> so K extends string is the inferred type — every dot becomes a path-leg separator, letting an attacker traverse from the intended key into sibling and child fields the developer never meant to expose. The result is read access (and, in update statements, write access) to JSON sub-fields outside the intended scope across MySQL, PostgreSQL ->$/->>$, and SQLite. This vulnerability is fixed in 0.28.17."
    },
    {
      "lang": "es",
      "value": "Kysely es un constructor de consultas SQL de TypeScript con seguridad de tipos. Desde la versión 0.26.0 hasta la 0.28.16, DefaultQueryCompiler.visitJSONPathLeg no escapa los metacaracteres de ruta JSON (., [, ], *, **, ?). Cuando una entrada controlada por el atacante fluye hacia eb.ref(col, ’  ->  $’).key(input) o .at(input) - incluyendo código con seguridad de tipos donde la columna JSON tiene la forma de Record<string, T> de modo que K extends string es el tipo inferido - cada punto se convierte en un separador de segmento de ruta, permitiendo a un atacante atravesar desde la clave prevista hacia campos hermanos e hijos que el desarrollador nunca tuvo la intención de exponer. El resultado es acceso de lectura (y, en sentencias de actualización, acceso de escritura) a subcampos JSON fuera del alcance previsto en MySQL, PostgreSQL ’  ->  $’/’  ->  >$’, y SQLite. Esta vulnerabilidad está corregida en la versión 0.28.17."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "kysely-org",
          "product": "kysely",
          "versions": [
            {
              "version": ">= 0.26.0, < 0.28.17",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T13:57:03.166633Z",
          "id": "CVE-2026-44635",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-89"
        },
        {
          "lang": "en",
          "value": "CWE-915"
        },
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/kysely-org/kysely/security/advisories/GHSA-pv5w-4p9q-p3v2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/kysely-org/kysely/security/advisories/GHSA-pv5w-4p9q-p3v2",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}