CVE-2026-39356

OVERVIEW CVE-2026-39356 is an SQL injection vulnerability in Drizzle ORM, a popular TypeScript object-relational mapping library. Affected versions prior to 0.45.2 and 1.0.0-beta.20 fail to properly escape quoted SQL identifiers, allowing attackers to break out of quoted contexts and inject arbitrary SQL. The vulnerability exists in the escapeName() function implementations across dialect-specific code and can be exploited through APIs like sql.identifier() and .as() when processing attacker-controlled input. SEVERITY The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. While attack complexity is low, the impact is limited to confidentiality compromise, with no direct impact on integrity or availability. The EPSS score of 0.00016 indicates this vulnerability currently ranks lower in probability of exploitation compared to the broader CVE landscape. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, and this vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog. No public exploit code or proof-of-concept has gained community traction. However, the moderate FAUCET Risk Score of 48.0 suggests organizations using affected Drizzle versions should prioritize patching, as the SQL injection vector could enable unauthorized data access in applications processing user-supplied identifiers.