{"cve":"CVE-2026-39356","nvd":{"published":"2026-04-07T20:16:29.610","modified":"2026-07-20T20:10:00.110","status":"Analyzed","description":"Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or backticks. As a result, applications that pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier(), .as(), may allow an attacker to terminate the quoted identifier and inject SQL. This vulnerability is fixed in 0.45.2 and 1.0.0-beta.20.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-89"],"references":["https://github.com/drizzle-team/drizzle-orm/security/advisories/GHSA-gpj5-g38j-94v9"],"products":["drizzle:drizzle"],"source":"nvd","synced_at":"2026-10-19T22:28:59.047572785+00:00"},"epss":{"cve":"CVE-2026-39356","score":0.00392,"percentile":0.33361,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-gpj5-g38j-94v9","url":"https://osv.dev/vulnerability/GHSA-gpj5-g38j-94v9","summary":"Drizzle ORM has SQL injection via improperly escaped SQL identifiers","modified":"2026-04-08T00:41:21.252804Z","packages":[{"ecosystem":"npm","name":"drizzle-orm","purl":"pkg:npm/drizzle-orm","ranges":["<0.45.2"],"fixed":["0.45.2"]},{"ecosystem":"npm","name":"drizzle-orm","purl":"pkg:npm/drizzle-orm","ranges":[">=1.0.0-beta.2 <1.0.0-beta.20"],"fixed":["1.0.0-beta.20"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}