CVE-2026-44635

{"id": "CVE-2026-44635", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44635", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T13:57:03.166633Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kysely-org", "product": "kysely", "versions": [{"status": "affected", "version": ">= 0.26.0, < 0.28.17"}]}]}], "published": "2026-05-27T19:16:20.947", "references": [{"url": "https://github.com/kysely-org/kysely/security/advisories/GHSA-pv5w-4p9q-p3v2", "source": "security-advisories@github.com"}, {"url": "https://github.com/kysely-org/kysely/security/advisories/GHSA-pv5w-4p9q-p3v2", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-89"}, {"lang": "en", "value": "CWE-915"}, {"lang": "en", "value": "CWE-1284"}]}], "descriptions": [{"lang": "en", "value": "Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (., [, ], *, **, ?). When attacker-controlled input flows into eb.ref(col, '->$').key(input) or .at(input) \u2014 including type-safe code where the JSON column is shaped like Record<string, T> so K extends string is the inferred type \u2014 every dot becomes a path-leg separator, letting an attacker traverse from the intended key into sibling and child fields the developer never meant to expose. The result is read access (and, in update statements, write access) to JSON sub-fields outside the intended scope across MySQL, PostgreSQL ->$/->>$, and SQLite. This vulnerability is fixed in 0.28.17."}, {"lang": "es", "value": "Kysely es un constructor de consultas SQL de TypeScript con seguridad de tipos. Desde la versi\u00f3n 0.26.0 hasta la 0.28.16, DefaultQueryCompiler.visitJSONPathLeg no escapa los metacaracteres de ruta JSON (., [, ], *, **, ?). Cuando una entrada controlada por el atacante fluye hacia eb.ref(col, \u2019 -> $\u2019).key(input) o .at(input) - incluyendo c\u00f3digo con seguridad de tipos donde la columna JSON tiene la forma de Record<string, T> de modo que K extends string es el tipo inferido - cada punto se convierte en un separador de segmento de ruta, permitiendo a un atacante atravesar desde la clave prevista hacia campos hermanos e hijos que el desarrollador nunca tuvo la intenci\u00f3n de exponer. El resultado es acceso de lectura (y, en sentencias de actualizaci\u00f3n, acceso de escritura) a subcampos JSON fuera del alcance previsto en MySQL, PostgreSQL \u2019 -> $\u2019/\u2019 -> >$\u2019, y SQLite. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.28.17."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}