Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings
Date: 2026-03
Affected: npm/kysely
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33468
CWE: CWE-89
CVSS: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

## Summary Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`. ## Details The root cause is in `DefaultQueryCompiler.sanitizeStringLiteral()`: **`src/query-compiler/default-query-compiler.ts:1819-1821`** ```typescript protected sanitizeStringLiteral(value: string): string { return value.replace(LIT_WRAP_REGEX, "''") } ``` Where `LIT_WRAP_REGEX` is defined as `/'/g` (line 121). This only doubles single quotes — it does not escape backslash characters. The function is called from `appendStringLiteral()` which wraps the sanitized value in single quotes: **`src/query-compiler/default-query-compiler.ts:1841-1845`** ```typescript protected appendStringLiteral(value: string): void { this.append("'") this.append(this.sanitizeStringLiteral(value)) this.append("'") } ``` This is reached when `visitValue()` encounters an immediate value node (line 525-527), which is created by `ImmediateValueTransformer` used in `CreateIndexBuilder.where()`: **`src/schema/create-index-builder.ts:266-278`** ```typescr


Mitigations:

Architectural layers (MAESTRO):