CVE-2026-44635: Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`

Synopsis

This is a JSON-path traversal injection vulnerability in Kysely, the TypeScript SQL query builder, affecting versions 0.26.0 through 0.28.16. The flaw is reachable over the network with no authentication required, because the vulnerable code path sits inside query compilation: any attacker-controlled string that flows into `JSONPathBuilder.key()` or `.at()` can embed unescaped metacharacters (`.`, `[`, `]`, `*`, `?`) that the compiler passes directly to the database engine as raw path syntax. Successful exploitation gives the attacker read access to JSON sub-fields outside the intended scope in SELECT statements, and write access to those same fields in UPDATE statements, across MySQL, PostgreSQL, and SQLite backends. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attack is delivered over the network: any HTTP request or API call that passes user-supplied input into a Kysely JSON-path expression reaches the vulnerable code path without requiring local access.

• AuthenticationNot required

  No credentials are needed; the CVSS vector specifies PR:N, meaning an unauthenticated attacker can supply the malicious path string through any public-facing endpoint that constructs JSON-path queries.

• Victim interactionNot required

  No user interaction is required; the attacker triggers the injection directly by sending a crafted request, with no social-engineering step needed.

• Attack complexityDetail

  Attack complexity is low (AC:L): the exploit is reliable and condition-free, requiring only that attacker-controlled input reaches a `JSONPathBuilder.key()` or `.at()` call, with no race condition or environment-specific setup needed.

Blast Radius

• Reads JSON sub-fields in the targeted database column that the application developer never intended to expose, including sibling keys and nested child objects within the same JSON document.
• In UPDATE statement contexts, writes arbitrary values into those same out-of-scope JSON sub-fields, corrupting application state or overwriting access-control or configuration data stored as JSON.
• Affects all three supported database backends (MySQL, PostgreSQL, SQLite), so any Kysely-backed service querying JSON columns is in scope regardless of the underlying database engine.
• The vulnerability bypasses TypeScript's type safety guarantees: even code where the column type is inferred as `Record<string, T>` is exploitable, so developer confidence in type-checked queries does not indicate safety.