CVE-2026-44635 Overview
CVE-2026-44635 is a path traversal vulnerability in Kysely, a type-safe TypeScript SQL query builder. The flaw exists in DefaultQueryCompiler.visitJSONPathLeg, which fails to escape JSON-path metacharacters including ., [, ], *, **, and ?. Attackers can supply crafted input to eb.ref(col, '->$').key(input) or .at(input) calls and traverse into sibling and child JSON fields outside the developer's intended scope. The vulnerability affects Kysely versions 0.26.0 through 0.28.16 across MySQL, PostgreSQL, and SQLite backends. Kysely 0.28.17 contains the fix.
Critical Impact
Attacker-controlled input can read JSON sub-fields outside the intended scope and write to those fields in update statements, exposing sensitive data across MySQL, PostgreSQL, and SQLite backends.
Affected Products
- Kysely versions 0.26.0 through 0.28.16
- Applications using eb.ref(col, '->$').key(input) with attacker-controlled input
- Applications using .at(input) for JSON traversal on MySQL, PostgreSQL, or SQLite
Discovery Timeline
- 2026-05-27 - CVE-2026-44635 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-44635
Vulnerability Analysis
Kysely provides a type-safe interface for building SQL queries in TypeScript. The library supports JSON column traversal through helpers like eb.ref(col, '->$').key(input) and .at(input). These helpers ultimately invoke DefaultQueryCompiler.visitJSONPathLeg to emit JSON path expressions for the target database.
The compiler does not escape JSON-path metacharacters before embedding user input into the path expression. Characters such as ., [, ], *, **, and ? retain their structural meaning when passed through. An attacker controlling the key argument can inject path separators and wildcards to navigate outside the intended JSON sub-tree.
The type system does not prevent the issue. When the JSON column is shaped as Record<string, T>, the inferred type K extends string accepts arbitrary strings, so type-safe code paths remain vulnerable. The flaw is classified under [CWE-22] Path Traversal.
Root Cause
The root cause is missing input sanitization in DefaultQueryCompiler.visitJSONPathLeg. The function concatenates the caller-supplied key into a JSON path string without escaping reserved metacharacters. A single . in attacker input becomes a path-leg separator in the emitted SQL, breaking the boundary between a single key access and multi-level traversal.
Attack Vector
An attacker submits input that contains JSON-path metacharacters to any application endpoint that forwards untrusted strings into .key() or .at() calls on a Kysely JSON reference. In read queries, the resulting SQL returns JSON sub-fields the developer did not intend to expose. In UPDATE statements, the same primitive grants write access to sibling and child fields, allowing tampering with adjacent data inside the JSON document.
The vulnerability mechanism is documented in the Kysely GitHub Security Advisory GHSA-pv5w-4p9q-p3v2. No public proof-of-concept exploit is currently listed.
Detection Methods for CVE-2026-44635
Indicators of Compromise
- SQL query logs containing JSON path expressions with unexpected ., [, ], *, or ? characters originating from user-supplied input
- Application logs showing JSON column reads or updates that return or modify fields outside the documented API contract
- Anomalous response sizes from endpoints that normally return a single JSON sub-field
Detection Strategies
- Audit the codebase for calls to eb.ref(col, '->$').key(...) and .at(...) and verify the argument source for each call site
- Enable database query logging and search for JSON path operators (->$, ->>$) containing multiple path legs derived from request parameters
- Run dependency scanners against package.json and lockfiles to flag Kysely versions between 0.26.0 and 0.28.16
Monitoring Recommendations
- Alert on HTTP request parameters containing JSON-path metacharacters such as ., [, ], *, or ? when those parameters feed database lookups
- Track query duration and result-set size deltas on endpoints that traverse JSON columns to surface scope-expansion attempts
- Forward database audit logs to a central analytics platform and correlate path-traversal patterns with the originating user session
How to Mitigate CVE-2026-44635
Immediate Actions Required
- Upgrade Kysely to version 0.28.17 or later in all affected services
- Identify every call to .key() and .at() on JSON references and validate that arguments are constrained to a known allow-list
- Reject any user input containing JSON-path metacharacters before it reaches the query builder
Patch Information
Kysely 0.28.17 resolves the vulnerability by escaping JSON-path metacharacters in DefaultQueryCompiler.visitJSONPathLeg. Upgrade guidance and patch details are available in the Kysely GitHub Security Advisory GHSA-pv5w-4p9q-p3v2.
Workarounds
- Restrict .key() and .at() arguments to values from a server-side allow-list rather than direct request input
- Apply input validation that rejects strings containing ., [, ], *, or ? before passing them to JSON path helpers
- Move sensitive fields out of shared JSON columns into dedicated columns with explicit access control until the upgrade is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
