drizzle-team vulnerabilities and threats

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	7.5	EPSS 0.4%	CVE-2026-39356drizzle-orm · SQL Injection High7.5EPSS 0.4%2026-04-07CVE Database V5CVE-2026-39356 CVE-2026-39356 is a high-severity SQL injection vulnerability in the drizzle-orm TypeScript ORM. Versions prior to 0.45.2 and before 1.0.0-beta.20 improperly escape quoted SQL identifiers, allowing attacker-controlled input to break out of quoted identifiers and inject SQL commands. This occurs in APIs that construct SQL identifiers or aliases, such as sql.identifier() and . as(). EPSS 0.4%Vulnerability drizzle-team CWE-89	CVE Database V5	2026-04-07

Page 1 of 1