PT-2026-31003 · Drizzle · Drizzle

0X90Sh + 1 · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-39356

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drizzle versions prior to 0.45.2 and 1.0.0-beta.20

Description Drizzle ORM does not properly escape quoted SQL identifiers in its escapeName() implementations. This can allow an attacker to terminate the quoted identifier and inject SQL when applications pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier() and .as().

Recommendations Update to version 0.45.2 or 1.0.0-beta.20.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39356

GHSA-GPJ5-G38J-94V9

Affected Products

Drizzle

References · 5

• https://github.com/drizzle-team/drizzle-orm/security/advisories/GHSA-gpj5-g38j-94v9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gpj5-g38j-94v9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39356 · Security Note
• https://github.com/drizzle-team/drizzle-orm · Note
• https://twitter.com/CVEnew/status/2041711885893169600 · Twitter Post