A critical SQL injection vulnerability in the Kysely TypeScript SQL query builder allows unauthenticated attackers to execute arbitrary SQL commands against MySQL and SQLite databases.

The vulnerability exists in the visitJSONPathLeg function, which fails to properly escape single quotes when handling JSON path segments from .key() and .at() methods. This flaw allows an unauthenticated attacker to break out of the intended JSON path string context and inject malicious SQL commands.

Successful exploitation of this vulnerability can lead to unauthorized data access, modification, or exposure of sensitive information within the backend database. With a CVSS score of 8.2, this flaw poses a significant risk to data integrity and confidentiality, potentially leading to widespread system compromise if the application connects to the database with elevated privileges.

Immediate Action: Update the Kysely package to version 0.28.12 or later to apply the necessary security fixes for JSON path sanitization.

Proactive Monitoring: Review database query logs for unusual syntax, particularly strings containing unexpected single quotes or JSON path-related functions that deviate from established application patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to detect and block malicious payloads directed at endpoints utilizing Kysely for dynamic query generation.

Public Exploit Available: Unknown

Given the high CVSS score and the existence of a proof-of-concept, this vulnerability represents a significant risk to application security. Organizations using Kysely should prioritize upgrading to version 0.28.12 immediately to eliminate the injection vector. Failure to patch may expose backend databases to unauthorized command execution and data extraction by unauthenticated remote actors.