Keyv/MySQL — SQL Injection
- An unauthenticated SQL Injection was found in the @keyv/mysql adapter.
- Key-value abstractions are trusted implicitly, so a flaw here has outsized impact.
- Tracking exact package/version inventory is what enables rapid response.
Keyv is a simple key-value store abstraction that lets applications persist data across many different databases through a consistent interface.
Our research uncovered an SQL Injection vulnerability in the @keyv/mysql adapter that can be triggered without authentication. Because key-value abstractions are often trusted implicitly and used deep inside application logic, a flaw at this layer can have outsized impact.
The finding is a reminder that supply-chain risk is not limited to headline dependencies — the small, ubiquitous adapters that glue systems together deserve the same scrutiny. Tracking exactly which packages and versions run in your environment is what makes rapid response possible.
Frequently asked questions
What is the impact of the Keyv/MySQL SQL Injection?
Because the vulnerability is unauthenticated and sits in a widely-used adapter deep in application logic, an attacker could manipulate database queries without credentials — a high-impact flaw in an easily-overlooked dependency.
How can teams reduce this class of supply-chain risk?
Give small, ubiquitous adapters the same scrutiny as headline dependencies, and keep an accurate inventory of which packages and versions run in production so you can respond the moment an advisory lands.