SQL injection in CodeIgniter4 Query Builder deleteBatch() (CVE-2026-63221)

A SQL injection vulnerability exists in the Query Builder's `deleteBatch()` method in CodeIgniter4. When `deleteBatch()` is used with `where()` conditions, bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, meaning they are never escaped or quoted. Applications that pass user-controlled input to `where()` before calling `deleteBatch()` are vulnerable to SQL injection, potentially allowing unauthorized data access, modification, or deletion. Affected versions: - >= 4.3.0, < 4.7.4 We recommend updating to: 4.7.4. CVSS 9.4 · our assessment: act_now Reference: https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c9w5-rwh3-7pm9 Details: https://vuln.today/cve/CVE-2026-63221