github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8704] Transitive dependency kysely@0.28.11 affected by CVE-2026-32763 (SQL injection) #28489

New Issue
Open
opened 2026-04-17 19:56:33 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-17 19:56:33 -05:00
Owner
Copy Link

Originally created by @msnelling on GitHub (Mar 20, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8704

Summary

@better-auth/kysely-adapter@1.5.5 declares a peer dependency of "kysely": "^0.27.0 || ^0.28.0", which allows resolution to kysely@0.28.11 — a version affected by CVE-2026-32763 (CVSS 8.2 HIGH).

Vulnerability Details

  • CVE: CVE-2026-32763
  • CWE: CWE-89 (SQL Injection)
  • Affected versions: kysely 0.26.0 – 0.28.11
  • Fixed in: kysely 0.28.12+
  • Dialects affected: MySQL and SQLite (PostgreSQL is not affected)

The visitJSONPathLeg() function in Kysely appends user-controlled values from .key() and .at() directly into single-quoted JSON path string literals without escaping single quotes, enabling UNION-based SQL injection and data exfiltration.

Impact on better-auth consumers

Projects using @better-auth/kysely-adapter with a SQLite or MySQL backend may resolve to a vulnerable Kysely version unless they add explicit overrides in their package.json.

Suggested fix

Bump the minimum Kysely version in @better-auth/kysely-adapter's peer dependency to >=0.28.12:

"peerDependencies": {
  "kysely": "^0.28.12"
}

Or alternatively pin the dev/production dependency to >=0.28.12.

Workaround

Consumers can add an override in their own package.json:

"overrides": {
  "kysely": "0.28.12"
}

References

Originally created by @msnelling on GitHub (Mar 20, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8704 ## Summary `@better-auth/kysely-adapter@1.5.5` declares a peer dependency of `"kysely": "^0.27.0 || ^0.28.0"`, which allows resolution to `kysely@0.28.11` — a version affected by **CVE-2026-32763** (CVSS 8.2 HIGH). ## Vulnerability Details - **CVE**: [CVE-2026-32763](https://nvd.nist.gov/vuln/detail/CVE-2026-32763) - **CWE**: CWE-89 (SQL Injection) - **Affected versions**: kysely 0.26.0 – 0.28.11 - **Fixed in**: kysely 0.28.12+ - **Dialects affected**: MySQL and SQLite (PostgreSQL is not affected) The `visitJSONPathLeg()` function in Kysely appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals without escaping single quotes, enabling UNION-based SQL injection and data exfiltration. ## Impact on better-auth consumers Projects using `@better-auth/kysely-adapter` with a **SQLite or MySQL** backend may resolve to a vulnerable Kysely version unless they add explicit overrides in their package.json. ## Suggested fix Bump the minimum Kysely version in `@better-auth/kysely-adapter`'s peer dependency to `>=0.28.12`: ```json "peerDependencies": { "kysely": "^0.28.12" } ``` Or alternatively pin the dev/production dependency to `>=0.28.12`. ## Workaround Consumers can add an override in their own `package.json`: ```json "overrides": { "kysely": "0.28.12" } ``` ## References - [kysely-org/kysely#1752](https://github.com/kysely-org/kysely/issues/1752) - [kysely 0.28.12 release](https://github.com/kysely-org/kysely/releases/tag/0.28.12)
GiteaMirror added the databasebug labels 2026-04-17 19:56:34 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug database
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#28489
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?