https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33468.htmlhttps://patchthecve.com/cve/CVE-2026-33468.htmlWed, 17 Jun 2026 10:37:32 +0000HIGH 8.1: Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by defhttps://patchthecve.com/cve/CVE-2026-33442.htmlhttps://patchthecve.com/cve/CVE-2026-33442.htmlWed, 17 Jun 2026 10:37:30 +0000HIGH 8.1: Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely's query compiler escapes single quotes (`'` → `''`) but does not escape backslashes. On MySQL with the default `BACKSLASH_ESCAPES` SQL mode, an attacker can inject a backhttps://patchthecve.com/cve/CVE-2026-32763.htmlhttps://patchthecve.com/cve/CVE-2026-32763.htmlWed, 17 Jun 2026 10:36:20 +0000HIGH 8.2: Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JS