CVE-2026-63221

Name of the Vulnerable Software and Affected Versions CodeIgniter versions 4.3.0 through 4.7.3

Description In the Query Builder, the deleteBatch() function substitutes bound values from where() conditions into generated SQL while ignoring their escape flags. This allows user-controlled condition values to be interpreted as SQL. This issue is specific to the deleteBatch() code path, whereas regular delete() operations handle where() binds correctly.

Recommendations Update to version 4.7.4. As a temporary workaround, avoid using the deleteBatch() function until the update is applied.