{"action":"Upgrade kysely to 0.28.17 or later.","affected":[{"fixed":"0.28.17","introduced":"0.26.0"}],"component":"kysely","cve_ids":["CVE-2026-44635"],"ecosystem":"npm","epss":0.00362,"exploited":false,"fixed_versions":["0.28.17"],"ghsa_id":"GHSA-pv5w-4p9q-p3v2","id":"tcs_01M5KG4FCYSANRW1TXQHCFF7FF","modified_at":"2026-06-09T00:00:17.762179524Z","published_at":"2026-05-11T19:40:15Z","references":["https://osv.dev/vulnerability/GHSA-pv5w-4p9q-p3v2","https://github.com/kysely-org/kysely/security/advisories/GHSA-pv5w-4p9q-p3v2","https://nvd.nist.gov/vuln/detail/CVE-2026-44635","https://github.com/kysely-org/kysely","https://github.com/kysely-org/kysely/releases/tag/v0.28.17"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-pv5w-4p9q-p3v2","url":"https://osv.dev/vulnerability/GHSA-pv5w-4p9q-p3v2"}],"summary":"Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`"}