Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kysely-org/kysely

              master @ 5442d95
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

SQL Injection: 5 prior fixes. Scrutinize any change in this area.

src/query-compiler/default-query-compiler.ts: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Inadequate escaping of string literals and identifier wrapper characters in the default query compiler allows attackers to inject arbitrary SQL statements, particularly when backslash escapes or single quotes are not properly handled.

SQL Injection: MySQL-specific dialect overrides failed to correctly account for default BACKSLASH_ESCAPES mode, allowing attackers to exploit backslash characters to break out of string literal boundaries.

SQL Injection: The compilation of JSON path keys (e.g., via .key() or .at()) failed to properly escape quotes and backslashes, leading to severe SQL injection vulnerabilities during query generation.