{"action":"Upgrade kysely to 0.28.14 or later.","affected":[{"fixed":"0.28.14","introduced":"0.28.12"}],"component":"kysely","cve_ids":["CVE-2026-33442"],"ecosystem":"npm","epss":0.0045,"exploited":false,"fixed_versions":["0.28.14"],"ghsa_id":"GHSA-fr9j-6mvq-frcv","id":"tcs_01M5KFP5TJPT55D2RXHH8TBW97","modified_at":"2026-03-27T21:18:51.182705Z","published_at":"2026-03-20T20:48:33Z","references":["https://osv.dev/vulnerability/GHSA-fr9j-6mvq-frcv","https://github.com/kysely-org/kysely/security/advisories/GHSA-fr9j-6mvq-frcv","https://nvd.nist.gov/vuln/detail/CVE-2026-33442","https://github.com/kysely-org/kysely"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-fr9j-6mvq-frcv","url":"https://osv.dev/vulnerability/GHSA-fr9j-6mvq-frcv"}],"summary":"Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys."}