CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-39356

Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was wrapped in quotes or backticks. As a result, applications that pass attacker-controlled input to APIs that construct SQL identifiers or aliases, such as sql.identifier(), .as(), may allow an attacker to terminate the quoted identifier and inject SQL. This vulnerability is fixed in 0.45.2 and 1.0.0-beta.20.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 12.9%

CVSS Severity

CVSS v3 Score 7.5

References

https://github.com/drizzle-team/drizzle-orm/security/advisories/GHSA-gpj5-g38j-94v9

Products affected by CVE-2026-39356

Drizzle » Drizzle » Version: 0.17.0

cpe:2.3:a:drizzle:drizzle:0.17.0
Drizzle » Drizzle » Version: 0.17.1

cpe:2.3:a:drizzle:drizzle:0.17.1
Drizzle » Drizzle » Version: 0.17.2

cpe:2.3:a:drizzle:drizzle:0.17.2
Drizzle » Drizzle » Version: 0.17.3

cpe:2.3:a:drizzle:drizzle:0.17.3
Drizzle » Drizzle » Version: 0.17.4

cpe:2.3:a:drizzle:drizzle:0.17.4
Drizzle » Drizzle » Version: 0.17.5

cpe:2.3:a:drizzle:drizzle:0.17.5
Drizzle » Drizzle » Version: 0.17.6

cpe:2.3:a:drizzle:drizzle:0.17.6
Drizzle » Drizzle » Version: 0.17.7

cpe:2.3:a:drizzle:drizzle:0.17.7
Drizzle » Drizzle » Version: 0.18.0

cpe:2.3:a:drizzle:drizzle:0.18.0
Drizzle » Drizzle » Version: 0.19.0

cpe:2.3:a:drizzle:drizzle:0.19.0
Drizzle » Drizzle » Version: 0.19.1

cpe:2.3:a:drizzle:drizzle:0.19.1
Drizzle » Drizzle » Version: 0.20.0

cpe:2.3:a:drizzle:drizzle:0.20.0
Drizzle » Drizzle » Version: 0.20.1

cpe:2.3:a:drizzle:drizzle:0.20.1
Drizzle » Drizzle » Version: 0.20.2

cpe:2.3:a:drizzle:drizzle:0.20.2
Drizzle » Drizzle » Version: 0.20.3

cpe:2.3:a:drizzle:drizzle:0.20.3
Drizzle » Drizzle » Version: 0.21.0

cpe:2.3:a:drizzle:drizzle:0.21.0
Drizzle » Drizzle » Version: 0.21.1

cpe:2.3:a:drizzle:drizzle:0.21.1
Drizzle » Drizzle » Version: 0.22.0

cpe:2.3:a:drizzle:drizzle:0.22.0
Drizzle » Drizzle » Version: 0.23.0

cpe:2.3:a:drizzle:drizzle:0.23.0
Drizzle » Drizzle » Version: 0.23.1

cpe:2.3:a:drizzle:drizzle:0.23.1
Drizzle » Drizzle » Version: 0.23.10

cpe:2.3:a:drizzle:drizzle:0.23.10
Drizzle » Drizzle » Version: 0.23.11

cpe:2.3:a:drizzle:drizzle:0.23.11
Drizzle » Drizzle » Version: 0.23.12

cpe:2.3:a:drizzle:drizzle:0.23.12
Drizzle » Drizzle » Version: 0.23.13

cpe:2.3:a:drizzle:drizzle:0.23.13
Drizzle » Drizzle » Version: 0.23.2

cpe:2.3:a:drizzle:drizzle:0.23.2
Drizzle » Drizzle » Version: 0.23.3

cpe:2.3:a:drizzle:drizzle:0.23.3
Drizzle » Drizzle » Version: 0.23.4

cpe:2.3:a:drizzle:drizzle:0.23.4
Drizzle » Drizzle » Version: 0.23.5

cpe:2.3:a:drizzle:drizzle:0.23.5
Drizzle » Drizzle » Version: 0.23.6

cpe:2.3:a:drizzle:drizzle:0.23.6
Drizzle » Drizzle » Version: 0.23.7

cpe:2.3:a:drizzle:drizzle:0.23.7
Drizzle » Drizzle » Version: 0.23.8

cpe:2.3:a:drizzle:drizzle:0.23.8
Drizzle » Drizzle » Version: 0.23.9

cpe:2.3:a:drizzle:drizzle:0.23.9
Drizzle » Drizzle » Version: 0.24.0

cpe:2.3:a:drizzle:drizzle:0.24.0
Drizzle » Drizzle » Version: 0.24.1

cpe:2.3:a:drizzle:drizzle:0.24.1
Drizzle » Drizzle » Version: 0.24.2

cpe:2.3:a:drizzle:drizzle:0.24.2
Drizzle » Drizzle » Version: 0.24.3

cpe:2.3:a:drizzle:drizzle:0.24.3
Drizzle » Drizzle » Version: 0.24.4

cpe:2.3:a:drizzle:drizzle:0.24.4
Drizzle » Drizzle » Version: 0.24.5

cpe:2.3:a:drizzle:drizzle:0.24.5
Drizzle » Drizzle » Version: 0.25.0

cpe:2.3:a:drizzle:drizzle:0.25.0
Drizzle » Drizzle » Version: 0.25.1

cpe:2.3:a:drizzle:drizzle:0.25.1
Drizzle » Drizzle » Version: 0.25.2

cpe:2.3:a:drizzle:drizzle:0.25.2
Drizzle » Drizzle » Version: 0.25.3

cpe:2.3:a:drizzle:drizzle:0.25.3
Drizzle » Drizzle » Version: 0.25.4

cpe:2.3:a:drizzle:drizzle:0.25.4
Drizzle » Drizzle » Version: 0.26.0

cpe:2.3:a:drizzle:drizzle:0.26.0
Drizzle » Drizzle » Version: 0.26.1

cpe:2.3:a:drizzle:drizzle:0.26.1
Drizzle » Drizzle » Version: 0.26.2

cpe:2.3:a:drizzle:drizzle:0.26.2
Drizzle » Drizzle » Version: 0.26.3

cpe:2.3:a:drizzle:drizzle:0.26.3
Drizzle » Drizzle » Version: 0.26.4

cpe:2.3:a:drizzle:drizzle:0.26.4
Drizzle » Drizzle » Version: 0.26.5

cpe:2.3:a:drizzle:drizzle:0.26.5
Drizzle » Drizzle » Version: 0.27.0

cpe:2.3:a:drizzle:drizzle:0.27.0
Drizzle » Drizzle » Version: 0.27.1

cpe:2.3:a:drizzle:drizzle:0.27.1
Drizzle » Drizzle » Version: 0.27.2

cpe:2.3:a:drizzle:drizzle:0.27.2
Drizzle » Drizzle » Version: 0.28.0

cpe:2.3:a:drizzle:drizzle:0.28.0
Drizzle » Drizzle » Version: 0.28.1

cpe:2.3:a:drizzle:drizzle:0.28.1
Drizzle » Drizzle » Version: 0.28.2

cpe:2.3:a:drizzle:drizzle:0.28.2
Drizzle » Drizzle » Version: 0.28.3

cpe:2.3:a:drizzle:drizzle:0.28.3
Drizzle » Drizzle » Version: 0.28.4

cpe:2.3:a:drizzle:drizzle:0.28.4
Drizzle » Drizzle » Version: 0.28.5

cpe:2.3:a:drizzle:drizzle:0.28.5
Drizzle » Drizzle » Version: 0.28.6

cpe:2.3:a:drizzle:drizzle:0.28.6
Drizzle » Drizzle » Version: 0.29.0

cpe:2.3:a:drizzle:drizzle:0.29.0
Drizzle » Drizzle » Version: 0.29.1

cpe:2.3:a:drizzle:drizzle:0.29.1
Drizzle » Drizzle » Version: 0.29.2

cpe:2.3:a:drizzle:drizzle:0.29.2
Drizzle » Drizzle » Version: 0.29.3

cpe:2.3:a:drizzle:drizzle:0.29.3
Drizzle » Drizzle » Version: 0.29.4

cpe:2.3:a:drizzle:drizzle:0.29.4
Drizzle » Drizzle » Version: 0.29.5

cpe:2.3:a:drizzle:drizzle:0.29.5
Drizzle » Drizzle » Version: 0.30.0

cpe:2.3:a:drizzle:drizzle:0.30.0
Drizzle » Drizzle » Version: 0.30.1

cpe:2.3:a:drizzle:drizzle:0.30.1
Drizzle » Drizzle » Version: 0.30.10

cpe:2.3:a:drizzle:drizzle:0.30.10
Drizzle » Drizzle » Version: 0.30.2

cpe:2.3:a:drizzle:drizzle:0.30.2
Drizzle » Drizzle » Version: 0.30.3

cpe:2.3:a:drizzle:drizzle:0.30.3
Drizzle » Drizzle » Version: 0.30.4

cpe:2.3:a:drizzle:drizzle:0.30.4
Drizzle » Drizzle » Version: 0.30.5

cpe:2.3:a:drizzle:drizzle:0.30.5
Drizzle » Drizzle » Version: 0.30.6

cpe:2.3:a:drizzle:drizzle:0.30.6
Drizzle » Drizzle » Version: 0.30.7

cpe:2.3:a:drizzle:drizzle:0.30.7
Drizzle » Drizzle » Version: 0.30.8

cpe:2.3:a:drizzle:drizzle:0.30.8
Drizzle » Drizzle » Version: 0.30.9

cpe:2.3:a:drizzle:drizzle:0.30.9
Drizzle » Drizzle » Version: 0.31.0

cpe:2.3:a:drizzle:drizzle:0.31.0
Drizzle » Drizzle » Version: 0.31.1

cpe:2.3:a:drizzle:drizzle:0.31.1
Drizzle » Drizzle » Version: 0.31.2

cpe:2.3:a:drizzle:drizzle:0.31.2
Drizzle » Drizzle » Version: 0.31.3

cpe:2.3:a:drizzle:drizzle:0.31.3
Drizzle » Drizzle » Version: 0.31.4

cpe:2.3:a:drizzle:drizzle:0.31.4
Drizzle » Drizzle » Version: 0.31.7

cpe:2.3:a:drizzle:drizzle:0.31.7
Drizzle » Drizzle » Version: 0.32.0

cpe:2.3:a:drizzle:drizzle:0.32.0
Drizzle » Drizzle » Version: 0.32.1

cpe:2.3:a:drizzle:drizzle:0.32.1
Drizzle » Drizzle » Version: 0.32.2

cpe:2.3:a:drizzle:drizzle:0.32.2
Drizzle » Drizzle » Version: 0.33.0

cpe:2.3:a:drizzle:drizzle:0.33.0
Drizzle » Drizzle » Version: 0.34.0

cpe:2.3:a:drizzle:drizzle:0.34.0
Drizzle » Drizzle » Version: 0.34.1

cpe:2.3:a:drizzle:drizzle:0.34.1
Drizzle » Drizzle » Version: 0.35.0

cpe:2.3:a:drizzle:drizzle:0.35.0
Drizzle » Drizzle » Version: 0.35.1

cpe:2.3:a:drizzle:drizzle:0.35.1
Drizzle » Drizzle » Version: 0.35.2

cpe:2.3:a:drizzle:drizzle:0.35.2
Drizzle » Drizzle » Version: 0.35.3

cpe:2.3:a:drizzle:drizzle:0.35.3
Drizzle » Drizzle » Version: 0.36.0

cpe:2.3:a:drizzle:drizzle:0.36.0
Drizzle » Drizzle » Version: 0.36.1

cpe:2.3:a:drizzle:drizzle:0.36.1
Drizzle » Drizzle » Version: 0.36.2

cpe:2.3:a:drizzle:drizzle:0.36.2
Drizzle » Drizzle » Version: 0.36.3

cpe:2.3:a:drizzle:drizzle:0.36.3
Drizzle » Drizzle » Version: 0.36.4

cpe:2.3:a:drizzle:drizzle:0.36.4
Drizzle » Drizzle » Version: 0.37.0

cpe:2.3:a:drizzle:drizzle:0.37.0
Drizzle » Drizzle » Version: 0.38.0

cpe:2.3:a:drizzle:drizzle:0.38.0
Drizzle » Drizzle » Version: 0.38.1

cpe:2.3:a:drizzle:drizzle:0.38.1
Drizzle » Drizzle » Version: 0.38.2

cpe:2.3:a:drizzle:drizzle:0.38.2
Drizzle » Drizzle » Version: 0.38.3

cpe:2.3:a:drizzle:drizzle:0.38.3
Drizzle » Drizzle » Version: 0.38.4

cpe:2.3:a:drizzle:drizzle:0.38.4
Drizzle » Drizzle » Version: 0.39.0

cpe:2.3:a:drizzle:drizzle:0.39.0
Drizzle » Drizzle » Version: 0.39.1

cpe:2.3:a:drizzle:drizzle:0.39.1
Drizzle » Drizzle » Version: 0.39.2

cpe:2.3:a:drizzle:drizzle:0.39.2
Drizzle » Drizzle » Version: 0.39.3

cpe:2.3:a:drizzle:drizzle:0.39.3
Drizzle » Drizzle » Version: 0.40.0

cpe:2.3:a:drizzle:drizzle:0.40.0
Drizzle » Drizzle » Version: 0.40.1

cpe:2.3:a:drizzle:drizzle:0.40.1
Drizzle » Drizzle » Version: 0.41.0

cpe:2.3:a:drizzle:drizzle:0.41.0
Drizzle » Drizzle » Version: 0.42.0

cpe:2.3:a:drizzle:drizzle:0.42.0
Drizzle » Drizzle » Version: 0.43.0

cpe:2.3:a:drizzle:drizzle:0.43.0
Drizzle » Drizzle » Version: 0.43.1

cpe:2.3:a:drizzle:drizzle:0.43.1
Drizzle » Drizzle » Version: 0.44.0

cpe:2.3:a:drizzle:drizzle:0.44.0
Drizzle » Drizzle » Version: 0.44.1

cpe:2.3:a:drizzle:drizzle:0.44.1
Drizzle » Drizzle » Version: 0.44.2

cpe:2.3:a:drizzle:drizzle:0.44.2
Drizzle » Drizzle » Version: 0.44.3

cpe:2.3:a:drizzle:drizzle:0.44.3
Drizzle » Drizzle » Version: 0.44.4

cpe:2.3:a:drizzle:drizzle:0.44.4
Drizzle » Drizzle » Version: 0.44.5

cpe:2.3:a:drizzle:drizzle:0.44.5
Drizzle » Drizzle » Version: 0.44.6

cpe:2.3:a:drizzle:drizzle:0.44.6
Drizzle » Drizzle » Version: 0.44.7

cpe:2.3:a:drizzle:drizzle:0.44.7
Drizzle » Drizzle » Version: 0.45.0

cpe:2.3:a:drizzle:drizzle:0.45.0
Drizzle » Drizzle » Version: 0.45.1

cpe:2.3:a:drizzle:drizzle:0.45.1
Drizzle » Drizzle » Version: 1.0.0

cpe:2.3:a:drizzle:drizzle:1.0.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-39356

Products

Pricing

Contact Us