PT-2026-31003

CVE-2026-39356

Published

2026-04-07

Updated

2026-07-20

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drizzle versions prior to 0.45.2 and 1.0.0-beta.20

Description Drizzle ORM does not properly escape quoted SQL identifiers in its escapeName() implementations. This can allow an attacker to terminate the quoted identifier and inject SQL when applications pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier() and .as().

Recommendations Update to version 0.45.2 or 1.0.0-beta.20.

Exploitability

Exploit

Fix

Impacts

Researchers

0X90Sh

Ethankim88

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')