packagist package report

Is codeigniter4/framework safe?

20 known vulnerabilities, worst severity CRITICAL.

cvss
9.4

how bad it is if exploited, out of 10

epss
0.40%

chance of exploitation in the next 30 days

xyz score
4.0

CyberXYZ composite, out of 10

fig. 01 — GHSA-c9w5-rwh3-7pm9, the advisory selected below

// advisories

GHSA-c9w5-rwh3-7pm9

CRITICALCVE-2026-63221

A SQL injection vulnerability exists in the Query Builder's deleteBatch() method. When deleteBatch() is used together with where() conditions, the bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, so they are never escaped or quoted. If an application passes user-controlled input to where() before calling deleteBatch(), that input is

Affected
>= 4.3.0, < 4.7.4
Fixed in
4.7.4
Weakness
CWE-89
Published
2026-08-07
Source
github

GHSANVDMITREreferencereferencereference

// dependencies

0 direct

Sign in for dependency paths and remediation

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so packagist packages are not covered.

Checked 2026-09-22 at 01:31 UTC. The most recent advisory here was published 2026-08-07. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.
Is codeigniter4/framework safe? packagist package security report | CyberXYZ