CVE-2026-39356

Status: AnalyzedHigh (7.5)—

Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or backticks. As a result, applications that pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier(), .as(), may allow an attacker to terminate the quoted identifier and inject SQL. This vulnerability is fixed in 0.45.2 and 1.0.0-beta.20.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base score: 7.5

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.42%
Percentile among all scored CVEs: 34
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access95 %
Primary impactT1005 Data from Local Systemcollection85 %
Secondary impactT1565.001 Stored Data Manipulationimpact80 %

SQL injection via unescaped identifiers en ORM expuesto a entrada controlada por atacante (CWE-89, AV:N/PR:N). Permite lectura (C:H) y manipulación de datos en BD.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Vulnerability Scanning Restrict File and Directory Permissions Privileged Account Management Remote Data Storage Network Segmentation Limit Access to Resource Over Network

Affected technologies (1)

Drizzle — Drizzle

CWEs

CWE-89

References

https://github.com/drizzle-team/drizzle-orm/security/advisories/GHSA-gpj5-g38j-94v9

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-39356",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39356",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-08T14:33:41.458749Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "drizzle-team",
          "product": "drizzle-orm",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.45.2"
            },
            {
              "status": "affected",
              "version": ">= 1.0.0-beta.2, < 1.0.0-beta.20"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-04-07T20:16:29.610",
  "references": [
    {
      "url": "https://github.com/drizzle-team/drizzle-orm/security/advisories/GHSA-gpj5-g38j-94v9",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or backticks. As a result, applications that pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier(), .as(), may allow an attacker to terminate the quoted identifier and inject SQL. This vulnerability is fixed in 0.45.2 and 1.0.0-beta.20."
    },
    {
      "lang": "es",
      "value": "Drizzle es un ORM moderno de TypeScript. Antes de 0.45.2 y 1.0.0-beta.20, Drizzle ORM escapaba incorrectamente los identificadores SQL entre comillas en sus implementaciones de escapeName() específicas del dialecto. En las versiones afectadas, los delimitadores de identificador incrustados no se escapaban antes de que el identificador fuera envuelto en comillas simples o comillas invertidas. Como resultado, las aplicaciones que pasan entrada controlada por el atacante a APIs que construyen identificadores o alias SQL, como sql.identifier(), .as(), pueden permitir a un atacante terminar el identificador entre comillas e inyectar SQL. Esta vulnerabilidad está corregida en 0.45.2 y 1.0.0-beta.20."
    }
  ],
  "lastModified": "2026-07-20T20:10:00.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC2CBAC7-A71B-431C-97E2-DDFCD8462EFF",
              "versionEndExcluding": "0.45.2"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta1:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60A3F747-3032-4D44-B1ED-155713253A2A"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta11:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9996B93A-33E9-4B59-81FD-0237BA1640C5"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta12:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E745776-500B-4A8B-814A-2CC201D90B87"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta13:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00F8DF93-174B-436A-AC04-A172D74166F1"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta14:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31E46EFF-7701-4568-82EF-4C8F47F80A2C"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta15:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3255145-91F5-44D8-9E01-FE2B82C31361"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta16:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D9BA061-A130-4EF2-AE8D-8A7BB8F62DCF"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta17:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72BA66E9-16BF-49CE-8311-02FD47A0D00C"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta18:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B00B0A98-D5BE-40E4-BD71-E87414DFC428"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta19:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "874F5CFB-661B-4E23-BBFA-902842ADCAEC"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta2:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8932680-10AA-4DC4-89D9-B0F691591612"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta3:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15C269C1-EDD4-4021-8356-0C8DACC21B5B"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta4:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62138634-891B-41A8-8252-B0ED90D038DB"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta5:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A75B6D6-43B8-4A40-B710-F7A1796579CC"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta6:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF332766-43B3-4F35-A7E0-3EE1AAE303B6"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta7:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD68C495-63AE-45C0-A714-158FAFE4B4E1"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta8:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBA1CC9C-B1AA-4CF1-A9A5-7961F8624B50"
            },
            {
              "criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta9:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67528631-A49B-40F7-8D1B-68F2BC208D2A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}