CVE-2026-39356

{"id": "CVE-2026-39356", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39356", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T14:33:41.458749Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "drizzle-team", "product": "drizzle-orm", "versions": [{"status": "affected", "version": "< 0.45.2"}, {"status": "affected", "version": ">= 1.0.0-beta.2, < 1.0.0-beta.20"}]}]}], "published": "2026-04-07T20:16:29.610", "references": [{"url": "https://github.com/drizzle-team/drizzle-orm/security/advisories/GHSA-gpj5-g38j-94v9", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or backticks. As a result, applications that pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier(), .as(), may allow an attacker to terminate the quoted identifier and inject SQL. This vulnerability is fixed in 0.45.2 and 1.0.0-beta.20."}, {"lang": "es", "value": "Drizzle es un ORM moderno de TypeScript. Antes de 0.45.2 y 1.0.0-beta.20, Drizzle ORM escapaba incorrectamente los identificadores SQL entre comillas en sus implementaciones de escapeName() espec\u00edficas del dialecto. En las versiones afectadas, los delimitadores de identificador incrustados no se escapaban antes de que el identificador fuera envuelto en comillas simples o comillas invertidas. Como resultado, las aplicaciones que pasan entrada controlada por el atacante a APIs que construyen identificadores o alias SQL, como sql.identifier(), .as(), pueden permitir a un atacante terminar el identificador entre comillas e inyectar SQL. Esta vulnerabilidad est\u00e1 corregida en 0.45.2 y 1.0.0-beta.20."}], "lastModified": "2026-07-20T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drizzle:drizzle:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "AC2CBAC7-A71B-431C-97E2-DDFCD8462EFF", "versionEndExcluding": "0.45.2"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta1:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "60A3F747-3032-4D44-B1ED-155713253A2A"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta11:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9996B93A-33E9-4B59-81FD-0237BA1640C5"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta12:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9E745776-500B-4A8B-814A-2CC201D90B87"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta13:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "00F8DF93-174B-436A-AC04-A172D74166F1"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta14:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "31E46EFF-7701-4568-82EF-4C8F47F80A2C"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta15:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B3255145-91F5-44D8-9E01-FE2B82C31361"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta16:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "0D9BA061-A130-4EF2-AE8D-8A7BB8F62DCF"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta17:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "72BA66E9-16BF-49CE-8311-02FD47A0D00C"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta18:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B00B0A98-D5BE-40E4-BD71-E87414DFC428"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta19:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "874F5CFB-661B-4E23-BBFA-902842ADCAEC"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta2:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B8932680-10AA-4DC4-89D9-B0F691591612"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta3:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "15C269C1-EDD4-4021-8356-0C8DACC21B5B"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta4:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "62138634-891B-41A8-8252-B0ED90D038DB"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta5:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2A75B6D6-43B8-4A40-B710-F7A1796579CC"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta6:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "EF332766-43B3-4F35-A7E0-3EE1AAE303B6"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta7:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "CD68C495-63AE-45C0-A714-158FAFE4B4E1"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta8:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "EBA1CC9C-B1AA-4CF1-A9A5-7961F8624B50"}, {"criteria": "cpe:2.3:a:drizzle:drizzle:1.0.0:beta9:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "67528631-A49B-40F7-8D1B-68F2BC208D2A"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}