npm/kysely CVE-2026-44635: high 7.5, EPSS 0.54%
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
Action: Upgrade kysely to 0.28.17 or later.
npm i kysely@0.28.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.26.0 | 0.28.17 | - |
Fixed versions
| 0.28.17 |
Sources
- osv: GHSA-pv5w-4p9q-p3v2
- https://github.com/kysely-org/kysely/security/advisories/GHSA-pv5w-4p9q-p3v2
- https://nvd.nist.gov/vuln/detail/CVE-2026-44635
- https://github.com/kysely-org/kysely
- https://github.com/kysely-org/kysely/releases/tag/v0.28.17
CVE-2026-44635 · published · modified · JSON