Drizzle ORM versions before 0.45.2 and between 1.0.0-beta.2 and 1.0.0-beta.20 contain an SQL injection vulnerability due to improper escaping of quoted SQL identifiers in dialect-specific escapeName() implementations. Specifically, embedded identifier delimiters were not escaped before wrapping identifiers in quotes or backticks. This flaw allows attackers to inject SQL by terminating quoted identifiers early when passing malicious input to APIs like sql.identifier() or .as(). The issue is resolved in versions 0.45.2 and 1.0.0-beta.20.

Successful exploitation can lead to SQL injection attacks allowing an attacker to execute arbitrary SQL commands. The CVSS 3.1 score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality only. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Users should upgrade to Drizzle ORM version 0.45.2 or later, or 1.0.0-beta.20 or later, where this vulnerability is fixed. Patch status is not explicitly stated but fixed versions are identified, so upgrading to these versions is the recommended remediation. No vendor advisory content contradicts this guidance.