CVE-2026-39356

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39356
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39356.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39356
Aliases
Published
2026-04-07T19:58:46.348Z
Modified
2026-08-12T03:51:25.617207782Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
SQL Injection via escapeName() in all Drizzle ORM SQL dialects
Details

Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or backticks. As a result, applications that pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier(), .as(), may allow an attacker to terminate the quoted identifier and inject SQL. This vulnerability is fixed in 0.45.2 and 1.0.0-beta.20.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39356.json",
    "cwe_ids": [
        "CWE-89"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/drizzle-team/drizzle-orm

Affected ranges

Type
GIT
Repo
https://github.com/drizzle-team/drizzle-orm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
273c78071d4841b497f5144734b38294df7ec64b
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:drizzle:drizzle:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.45.2"
        }
    ]
}

Affected versions

0.*
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.18.0
0.19.0
0.19.1
0.20.0
0.20.1
0.20.2
0.20.3
0.21.0
0.21.1
0.22.0
0.23.0
0.23.1
0.23.10
0.23.11
0.23.12
0.23.13
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.23.7
0.23.8
0.23.9
0.24.0
0.24.1
0.24.2
0.24.3
0.24.4
0.24.5
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.26.0
0.26.1
0.26.2
0.26.3
0.26.4
0.26.5
0.27.0
0.27.1
0.27.2
0.28.0
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.29.0
0.29.1
0.29.2
0.29.3
0.29.4
0.29.5
0.30.0
0.30.1
0.30.10
0.30.2
0.30.3
0.30.4
0.30.5
0.30.6
0.30.7
0.30.8
0.30.9
0.31.0
0.31.1
0.31.2
0.31.3
0.31.4
0.32.0
0.32.1
0.32.2
0.33.0
0.34.0
0.34.1
0.35.0
0.35.1
0.35.2
0.35.3
0.36.0
0.36.1
0.36.2
0.36.3
0.36.4
0.37.0
0.38.0
0.38.1
0.38.2
0.38.3
0.38.4
0.39.0
0.39.1
0.39.2
0.39.3
0.40.0
0.40.1
0.41.0
0.42.0
0.43.0
0.43.1
0.44.0
0.44.1
0.44.2
0.44.3
0.44.4
0.44.5
0.44.6
0.45.0
0.45.1
drizzle-kit@0.*
drizzle-kit@0.23.2
drizzle-kit@0.24.0
drizzle-kit@0.24.1
drizzle-kit@0.24.2
drizzle-kit@0.25.0
drizzle-kit@0.26.0
drizzle-kit@0.26.1
drizzle-kit@0.26.2
drizzle-kit@0.27.0
drizzle-kit@0.27.1
drizzle-kit@0.27.2
drizzle-kit@0.28.0
drizzle-kit@0.28.1
drizzle-kit@0.29.0
drizzle-kit@0.29.1
drizzle-kit@0.30.0
drizzle-kit@0.30.1
drizzle-kit@0.30.2
drizzle-kit@0.30.3
drizzle-kit@0.30.4
drizzle-kit@0.30.5
drizzle-kit@0.30.6
drizzle-kit@0.31.0
drizzle-kit@0.31.1
drizzle-kit@0.31.10
drizzle-kit@0.31.2
drizzle-kit@0.31.3
drizzle-kit@0.31.4
drizzle-kit@0.31.5
drizzle-kit@0.31.8
drizzle-kit@0.31.9
v.*
v.1.0.0-beta.7
v0.*
v0.31.7
v1.*
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.0.0-beta.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39356.json"