Drizzle ORM is vulnerable to SQL injection due to improper neutralization of special characters in SQL identifiers, creating a significant risk of unauthorized data access.

This is an SQL injection vulnerability (CWE-89) where the library fails to escape quoted SQL identifiers in its dialect-specific escapeName() functions. An unauthenticated attacker can supply crafted input to APIs like sql.identifier() or .as() to break out of quoted identifiers and execute arbitrary SQL commands.

Successful exploitation of this vulnerability allows unauthorized access to backend database information, which may lead to the exposure of sensitive user or corporate data. Given the CVSS score of 7.5, this is a high-severity risk that could result in significant data breaches or loss of data integrity within applications utilizing the affected ORM.

Immediate Action: Update the Drizzle ORM package to version 0.45.2 or 1.0.0-beta.20 immediately to incorporate the required security fixes.

Proactive Monitoring: Review application logs for unusual query patterns or unexpected SQL syntax errors that might indicate an injection attempt.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to detect and block common SQL injection patterns targeting identifiers within incoming HTTP requests.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

The risk posed by this SQL injection vulnerability is substantial, particularly for applications that pass untrusted user input into database queries. IT teams should prioritize updating Drizzle ORM to the patched versions across all environments to ensure database security and prevent potential data exfiltration.