CVE-2026-39356

Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or backticks. As a result, applications that pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier(), .as(), may allow an attacker to terminate the quoted identifier and inject SQL. This vulnerability is fixed in 0.45.2 and 1.0.0-beta.20.

• CWE-89

• https://github.com/drizzle-team/drizzle-orm/security/advisories/GHSA-gpj5-g38j-94v9Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jul 20, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3935Incorrect security UI in WebAppInstalls in Google Chrome pri…6.5
• CVE-2026-39350Istio is an open platform to connect, manage, and secure mic…5.4
• CVE-2026-39351Frappe is a full-stack web application framework. Prior to 1…9.1
• CVE-2026-39352Frappe is a full-stack web application framework. Versions p…8.7
• CVE-2026-39354Scoold is a Q&A and a knowledge sharing platform for teams. …6.5
• CVE-2026-39355Genealogy is a family tree PHP application. Prior to 5.9.1, …8.8
• CVE-2026-39358CubeCart is an ecommerce software solution. Prior to 6.6.0, …7.2
• CVE-2026-39359Wazuh is a free and open source platform used for threat pre…7.5
• CVE-2026-3936Use after free in WebView in Google Chrome on Android prior …8.8
• CVE-2026-39360RustFS is a distributed object storage system built in Rust.…4.3
• CVE-2026-39361OpenObserve is a cloud-native observability platform. In 0.7…7.7
• CVE-2026-39362InvenTree is an Open Source Inventory Management System. Pri…7.1