Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-c9w5-rwh3-7pm9
codeigniter4/frameworkImpact
A SQL injection vulnerability exists in the Query Builder's deleteBatch() method. When deleteBatch() is used together with where() conditions, the bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, so they are never escaped or quoted. If an application passes user-controlled input to where() before calling deleteBatch(), that input is interpreted as SQL rather than as a value, allowing SQL injection.
This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly.
Patches
Upgrade to v4.7.4 or later.
Workarounds
If you cannot upgrade immediately:
- Strictly validate and cast values (e.g. numeric IDs) before using them in conditions - though this does not fully protect string conditions.
- Do not pass user-controlled input to
where()when usingdeleteBatch(). - For user-controlled conditions, use a normal
delete()with Query Builder binds instead ofdeleteBatch(). - Where possible, express required matching values through the batch data and
onConstraint()rather than as separate user-controlledwhere()clauses.
Upload your own SBOM in CycloneDX 1.6 or higher (JSON) directly here to check your vulnerabilities.
Drag and drop some file here, or click to select
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a low impact on the confidentiality of the information. There is a high impact on the integrity of the data. There is a high impact on the availability of the system.
Exploitation activity has been observed. Apply available patches or mitigations urgently.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard