Drizzle ORM incorrectly escaped quoted SQL identifiers in its escapeName() implementations, allowing attacker-controlled input to terminate a quoted identifier and inject arbitrary SQL. This flaw directly maps to CWE-89 and can result in unintended data disclosure or modification through the manipulated SQL query.

Applications built with drizzle-team/drizzle-orm versions earlier than 0.45.2 for the stable branch or earlier than 1.0.0-beta.20 for the beta branch are affected. Any API that accepts attacker-controlled identifiers, such as sql.identifier() or .as(), can be vulnerable.

The CVSS score of 7.5 indicates moderate to high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not be widely exploited yet. Exploitation requires passing malicious input through an interface that constructs SQL identifiers; thus the attack vector is likely via application input (e.g., web form or API endpoint). While the vulnerability can lead to significant compromise of data integrity and confidentiality, it does not provide direct remote code execution. The risk is therefore substantial for exposed applications that accept arbitrary identifier input without validation.