CVE-2026-63221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63221
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63221.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63221
Aliases
  • GHSA-c9w5-rwh3-7pm9
Downstream
Published
2026-07-31T04:03:34.352Z
Modified
2026-08-02T03:31:59.434312996Z
Severity
  • 9.4 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H CVSS Calculator
Summary
CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
Details

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63221.json"
}
References

Affected packages

Git / github.com/codeigniter4/codeigniter4

Affected ranges

Type
GIT
Repo
https://github.com/codeigniter4/codeigniter4
Events
Introduced
f8e4ec57cb420e24c86e81eccef39c37ed257575
Fixed
2bd0f01d2813f9ec06db42643ce39d9f5428bf6d
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "4.3.0"
        },
        {
            "fixed": "4.7.4"
        }
    ]
}

Affected versions

v4.*
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.7
v4.3.8
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.4.8
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.5.5
v4.5.6
v4.5.7
v4.5.8
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.6.4
v4.6.5
v4.7.0
v4.7.1
v4.7.2
v4.7.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63221.json"