A critical SQL injection vulnerability in the Kysely TypeScript query builder allows unauthenticated attackers to execute arbitrary SQL commands via improper string literal sanitization.

The vulnerability exists in the DefaultQueryCompiler.sanitizeStringLiteral() method, which fails to escape backslashes when the MySQL dialect is configured with NO_BACKSLASH_ESCAPES disabled. An unauthenticated attacker can leverage this flaw in specific code paths, such as CreateIndexBuilder.where() and CreateViewBuilder.as(), to break out of string literals and perform SQL injection.

Successful exploitation of this flaw allows an attacker to manipulate database queries, potentially leading to unauthorized data exfiltration, modification, or complete database compromise. Given the CVSS score of 8.1, the high potential for total technical impact necessitates immediate attention to prevent severe integrity and confidentiality loss.

Immediate Action: Update the Kysely package to version 0.28.14 or later to implement the corrected string sanitization logic.

Proactive Monitoring: Review database query logs for unusual syntax, specifically looking for unexpected backslash usage or patterns indicative of SQL injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting string literal manipulation.

Public Exploit Available: No confirmed public weaponized exploit exists in the available data.

This vulnerability represents a significant risk to any application relying on Kysely for SQL query construction. Organizations using affected versions must prioritize upgrading to version 0.28.14 immediately to close the injection vector. Failure to patch may expose backend database systems to unauthorized command execution by unauthenticated remote actors.