Executive brief
Drizzle ORM is a tool used by developers to interact with databases in TypeScript applications. A security flaw in how it handles database names and aliases could allow an attacker to inject malicious commands into database queries. If an application uses user-provided text to name columns or sort data without proper validation, an attacker could potentially steal sensitive information or view restricted database records.
Technical details
A SQL injection vulnerability exists in Drizzle ORM's dialect-specific escapeName() implementations for PostgreSQL, MySQL, SQLite, SingleStore, and Gel. The root cause is the failure to escape embedded identifier delimiters (such as double quotes or backticks) before wrapping the identifier. An attacker can provide crafted input containing these delimiters to break out of the quoted identifier context and inject arbitrary SQL commands. This is particularly exploitable in patterns involving dynamic sorting or alias construction using untrusted runtime input. The issue is resolved in versions 0.45.2 and 1.0.0-beta.20.
Affected products
- drizzle-team drizzle-orm < 0.45.2, >= 1.0.0-beta.1 < 1.0.0-beta.20
Timeline
- 2026-04-06: advisory: GitHub Security Advisory published by maintainers
- 2026-04-07: disclosed: CVE-2026-39356 published to NVD
- 2026-04-07: patched: Fixes released in versions 0.45.2 and 1.0.0-beta.20