Drizzle ORM versions before 0.45.2 and 1.0.0-beta.20 contain a vulnerability where the dialect-specific escapeName() implementations do not properly escape embedded identifier delimiters before wrapping identifiers in quotes or backticks. This improper neutralization of special elements used in SQL commands (CWE-89) can allow an attacker to terminate quoted identifiers and inject arbitrary SQL via APIs that accept attacker-controlled input for SQL identifiers or aliases. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality but not integrity or availability.

An attacker can exploit this vulnerability to inject arbitrary SQL commands by manipulating input passed to APIs that construct SQL identifiers or aliases. This can lead to unauthorized disclosure of sensitive information (confidentiality impact). There is no indication of integrity or availability impact. No known exploits in the wild have been reported. The vulnerability affects applications using vulnerable versions of drizzle-orm that pass untrusted input to the affected APIs.

This vulnerability is fixed in drizzle-orm versions 0.45.2 and 1.0.0-beta.20. Users should upgrade to at least these versions to remediate the issue. Patch status is not explicitly stated in the vendor advisory, but the fix is included in these versions. Until upgraded, avoid passing untrusted input to APIs that construct SQL identifiers or aliases such as sql.identifier() and .as().