PACKAGIST · AUGUST 2026 · EARLY WARNING

CodeIgniter Query Builder SQL Injection Vulnerability Under Investigation

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
GHSA-C9W5-RWH3-7PM9Severity: HIGH

An SQL injection vulnerability in CodeIgniter's Query Builder deleteBatch() method when used with where() conditions is reportedly under investigation. Software engineers using CodeIgniter versions prior to 4.7.4 should assess their exposure.

What happened

A potential SQL injection vulnerability has been reported in the CodeIgniter Query Builder's deleteBatch() method when used in conjunction with where() conditions. This vulnerability appears to allow SQL injection if user-controlled input is passed to where() before calling deleteBatch(). The issue is reportedly affecting CodeIgniter versions prior to 4.7.4.

To assess your exposure, review your use of the deleteBatch() method with where() conditions. If user-controlled input is being passed to where() before calling deleteBatch(), your application may be vulnerable. It is recommended to upgrade to CodeIgniter v4.7.4 or later as a mitigation measure.

For more detailed information, consult the primary sources: [GHSA-c9w5-rwh3-7pm9](https://github.com/advisories/GHSA-c9w5-rwh3-7pm9) and [GHSA-mmj4-63m4-r6h5](https://github.com/advisories/GHSA-mmj4-63m4-r6h5). The severity of this issue is currently under investigation, and further details may become available as the investigation progresses.

How 0Day mitigates this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If codeigniter4 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Join the 0Day waitlist →

← Back to all threats