CVE-2026-39356: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39356 is a SQL injection vulnerability in Drizzle ORM, a modern TypeScript ORM for Node.js, caused by improper escaping of quoted SQL identifiers in dialect-specific escapeName() implementations. It affects all stable releases prior to 0.45.2 and all 1.0.0 beta releases from beta.2 through beta.19. The vulnerability was published on April 7, 2026, with patches released as versions 0.45.2 and 1.0.0-beta.20. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Drizzle Advisory).

The root cause (CWE-89) lies in the escapeName() function across multiple database dialect implementations — PostgreSQL, SQLite, Gel, MySQL, and SingleStore — which wraps identifiers in quotes or backticks but fails to escape embedded delimiter characters within the identifier value. Specifically, double-quote characters (") are not doubled to "" in PostgreSQL/SQLite/Gel dialects, and backtick characters (`) are not doubled to `` in MySQL/SingleStore dialects. This allows an attacker who controls input passed to APIs such as sql.identifier() or .as() to break out of the quoted identifier context and inject arbitrary SQL syntax. A representative vulnerable pattern involves dynamic sorting: const sortField = req.query.sort || 'id'; db.select().from(users).orderBy(sql.identifier(sortField)); (Drizzle Advisory).

Successful exploitation enables an unauthenticated, network-accessible attacker to inject arbitrary SQL commands into queries constructed by the affected application. Depending on the database dialect, query context, and database account permissions, this can result in blind or direct data disclosure, schema enumeration, query manipulation, privilege escalation, or destructive operations such as data deletion. The primary impact is high confidentiality loss; integrity and availability impacts depend on the database permissions granted to the application's database user. Only applications that pass untrusted runtime input into identifier or alias construction are affected — those using static schema objects or strict allowlists are not vulnerable (GitHub Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.017% (4th percentile), indicating a low near-term exploitation probability. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability requires no authentication and no user interaction, but exploitation is conditional on the application passing attacker-controlled input to the affected identifier APIs.

1. Identify target application: Locate a web application using Drizzle ORM (versions < 0.45.2 or 1.0.0-beta.2 through beta.19) that accepts user-supplied input for dynamic SQL identifier or alias construction (e.g., sort fields, report column names, CTE aliases).
2. Identify vulnerable endpoint: Find API endpoints or query parameters that are passed directly to sql.identifier() or .as() without allowlist validation — common in dynamic sorting or report-builder features.
3. Craft injection payload: Construct a malicious input string containing the dialect-specific identifier delimiter to break out of the quoted context. For PostgreSQL/SQLite, use a double-quote character (e.g., id" UNION SELECT password FROM users--); for MySQL/SingleStore, use a backtick (e.g., id` UNION SELECT password FROM users--).
4. Submit payload: Send the crafted input via the vulnerable HTTP parameter (e.g., GET /api/users?sort=id%22%20UNION%20SELECT%20password%20FROM%20users--).
5. Extract data: Observe the application response for injected query results, or use blind SQL injection techniques (time-based or boolean-based) if direct output is not returned, to enumerate schema and exfiltrate sensitive data (Drizzle Advisory).

• Network: Unusual HTTP requests containing SQL keywords (UNION, SELECT, FROM, --, SLEEP, WAITFOR) in query parameters associated with sorting, filtering, or alias fields; requests with URL-encoded quote or backtick characters in identifier-related parameters.
• Logs: Application or database logs showing malformed or unexpected SQL queries containing identifier delimiter characters (" or `) mid-query; database error messages referencing syntax errors in dynamically constructed identifiers.
• Application Behavior: Unexpected data returned in API responses inconsistent with the requested resource; anomalous query execution times suggesting time-based blind SQL injection attempts.

Upgrade Drizzle ORM to version 0.45.2 (stable) or 1.0.0-beta.20 (beta track) or later, which fix the identifier escaping logic in all affected dialects (Drizzle Advisory). As an interim workaround where immediate patching is not possible, implement strict allowlist validation for any user-supplied values passed to sql.identifier() or .as() — reject any input not matching a predefined set of known column or alias names. Conduct a code review to identify all locations where attacker-controlled data flows into identifier or alias construction APIs.

The vulnerability was reported by security researchers EthanKim88 and 0x90sh and disclosed by Drizzle ORM maintainer AndriiSherman via GitHub Security Advisories (Drizzle Advisory). Coverage appeared on The Hacker Wire and was shared on Bluesky by security community accounts shortly after disclosure. Community reaction has been moderate, consistent with a library-level SQL injection affecting a popular TypeScript ORM with a large user base (34.8k GitHub stars).