kysely

0.29.7 · 17 Oct 2026MIT12.8M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Paste your package.json, or type the range you declare for kysely. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	0.29.7	No known advisory
	0.28.18	Safe from 0.28.17
	0.27.6	31 open advisories, worst high · last release Mar 2025, no longer updated

Your version

High
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`GHSA-pv5w-4p9q-p3v2 · 11 May 2026
- 0.28.x0.28.0 – 0.28.16Fixed in 0.28.17
- 0.27.x and older0.26.0 – 0.27.6No fix, no longer updated · move to 0.28.17
High
Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL stringsGHSA-8cpq-38p9-67gx · 20 Mar 2026
- 0.28.x0.28.0 – 0.28.13Fixed in 0.28.14
- 0.27.x and older0.1.0 – 0.27.6No fix, no longer updated · move to 0.28.14
High
Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.GHSA-fr9j-6mvq-frcv · 20 Mar 2026
- 0.28.x0.28.12 – 0.28.13Fixed in 0.28.14
High
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.GHSA-wmrf-hv6w-mr66 · 18 Mar 2026
- 0.28.x0.28.0 – 0.28.11Fixed in 0.28.12
- 0.27.x and older0.26.0 – 0.27.6No fix, no longer updated · move to 0.28.12

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.