CVE-2026-39356

Estado: AnalizadaAlta (7.5)—

Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or backticks. As a result, applications that pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier(), .as(), may allow an attacker to terminate the quoted identifier and inject SQL. This vulnerability is fixed in 0.45.2 and 1.0.0-beta.20.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.42%
Percentil entre todas las CVEs puntuadas: 34
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1005 Data from Local Systemcollection85 %
Impacto secundarioT1565.001 Stored Data Manipulationimpact80 %

SQL injection via unescaped identifiers en ORM expuesto a entrada controlada por atacante (CWE-89, AV:N/PR:N). Permite lectura (C:H) y manipulación de datos en BD.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Restrict File and Directory Permissions Privileged Account Management Remote Data Storage Network Segmentation Limit Access to Resource Over Network

Tecnologías afectadas (1)

Drizzle — Drizzle

CWE

CWE-89

Referencias

https://github.com/drizzle-team/drizzle-orm/security/advisories/GHSA-gpj5-g38j-94v9

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-39356",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39356",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-08T14:33:41.458749Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "drizzle-team",
          "product": "drizzle-orm",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.45.2"
            },
            {
              "status": "affected",
              "version": ">= 1.0.0-beta.2, < 1.0.0-beta.20"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-04-07T20:16:29.610",
  "references": [
    {
      "url": "https://github.com/drizzle-team/drizzle-orm/security/advisories/GHSA-gpj5-g38j-94v9",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or backticks. As a result, applications that pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier(), .as(), may allow an attacker to terminate the quoted identifier and inject SQL. This vulnerability is fixed in 0.45.2 and 1.0.0-beta.20."
    },
    {
      "lang": "es",
      "value": "Drizzle es un ORM moderno de TypeScript. Antes de 0.45.2 y 1.0.0-beta.20, Drizzle ORM escapaba incorrectamente los identificadores SQL entre comillas en sus implementaciones de escapeName() específicas del dialecto. En las versiones afectadas, los delimitadores de identificador incrustados no se escapaban antes de que el identificador fuera envuelto en comillas simples o comillas invertidas. Como resultado, las aplicaciones que pasan entrada controlada por el atacante a APIs que construyen identificadores o alias SQL, como sql.identifier(), .as(), pueden permitir a un atacante terminar el identificador entre comillas e inyectar SQL. Esta vulnerabilidad está corregida en 0.45.2 y 1.0.0-beta.20."
    }
  ],
  "lastModified": "2026-07-20T20:10:00.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC2CBAC7-A71B-431C-97E2-DDFCD8462EFF",
              "versionEndExcluding": "0.45.2"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta1:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60A3F747-3032-4D44-B1ED-155713253A2A"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta11:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9996B93A-33E9-4B59-81FD-0237BA1640C5"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta12:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E745776-500B-4A8B-814A-2CC201D90B87"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta13:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00F8DF93-174B-436A-AC04-A172D74166F1"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta14:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31E46EFF-7701-4568-82EF-4C8F47F80A2C"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta15:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3255145-91F5-44D8-9E01-FE2B82C31361"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta16:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D9BA061-A130-4EF2-AE8D-8A7BB8F62DCF"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta17:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72BA66E9-16BF-49CE-8311-02FD47A0D00C"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta18:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B00B0A98-D5BE-40E4-BD71-E87414DFC428"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta19:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "874F5CFB-661B-4E23-BBFA-902842ADCAEC"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta2:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8932680-10AA-4DC4-89D9-B0F691591612"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta3:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15C269C1-EDD4-4021-8356-0C8DACC21B5B"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta4:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62138634-891B-41A8-8252-B0ED90D038DB"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta5:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A75B6D6-43B8-4A40-B710-F7A1796579CC"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta6:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF332766-43B3-4F35-A7E0-3EE1AAE303B6"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta7:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD68C495-63AE-45C0-A714-158FAFE4B4E1"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta8:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBA1CC9C-B1AA-4CF1-A9A5-7961F8624B50"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta9:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67528631-A49B-40F7-8D1B-68F2BC208D2A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}