The CodeIgniter 4 framework contains a SQL injection vulnerability (CVE-2026-63221) in the Query Builder's deleteBatch() method when combined with where() conditions. Specifically, bound values from the WHERE clause are inserted into the generated SQL query with their escape flags ignored, causing them to be unescaped and unquoted. This allows an attacker to inject arbitrary SQL if user-controlled input is passed to where() before calling deleteBatch(). This vulnerability is limited to the deleteBatch() code path; the regular delete() method correctly escapes where() binds. The vulnerability affects versions >=4.3.0 and <4.7.4. The vendor has released version 4.7.4 to address this issue.

Successful exploitation of this vulnerability can lead to SQL injection, allowing an attacker to execute arbitrary SQL commands. This can result in unauthorized data manipulation, data leakage, or denial of service. The CVSS score of 9.4 (critical) reflects the high impact on confidentiality, integrity, and availability. Since the vulnerability is exploitable remotely without authentication, it poses a significant risk to affected applications.

Upgrade to CodeIgniter version 4.7.4 or later, where this vulnerability is fixed. If immediate upgrade is not possible, avoid passing user-controlled input to where() when using deleteBatch(). Validate and cast input strictly, especially numeric IDs, though this does not fully protect string inputs. Alternatively, use the normal delete() method with Query Builder binds for user-controlled conditions or express matching values through batch data and onConstraint() instead of separate where() clauses.