CVE-2026-39356
1 advisory.
npm/drizzle-orm CVE-2026-39356: high 7.5
Drizzle ORM has SQL injection via improperly escaped SQL identifiers
Action: Upgrade drizzle-orm to 0.45.2 or later.
npm i drizzle-orm@0.45.2npm i drizzle-orm@1.0.0-beta.20Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.45.2 | - |
| 1.0.0-beta.2 | 1.0.0-beta.20 | - |
Fixed versions
| 0.45.2 | 1.0.0-beta.20 |
Sources
- osv: GHSA-gpj5-g38j-94v9
- https://github.com/drizzle-team/drizzle-orm/security/advisories/GHSA-gpj5-g38j-94v9
- https://nvd.nist.gov/vuln/detail/CVE-2026-39356
- https://github.com/drizzle-team/drizzle-orm
CVE-2026-39356 · published · modified · JSON