Starstruk Logo MarkStarstruk

0.45.2

drizzle-team/drizzle-orm0.45.2Mar 27, 2026by github-actions[bot]

AI Summary

Critical security patch fixing SQL injection vulnerability in sql.identifier() and sql.as() functions where values were not properly escaped.

Key Highlights

  • Fixed SQL injection (CWE-89) vulnerability in sql.identifier() and sql.as()
  • Security fix thanks to reporters @EthanKim88, @0x90sh and @wgoodall01

Full Release Notes

- Fixed `sql.identifier()`, `sql.as()` escaping issues. Previously all the values passed to this functions were not properly escaped
causing a possible SQL Injection (CWE-89) vulnerability

Thanks to @EthanKim88, @0x90sh and @wgoodall01 for reaching out to us with a reproduction and suggested fix