CVE-2026-94144 drogonframework CVE debrief

Who should care

Defenders responsible for systems using the drogonframework drogon library should assess exposure and prioritize verification of the library version used in their systems. They should also review compensating controls for exposed systems, check relevant monitoring and logs for suspicious activity, and track exceptions and retest remediated assets. Security teams and vulnerability management teams should be aware of the potential impact and plan for vendor-

Why it matters

CVE-2026-94144 is a SQL injection vulnerability in drogonframework drogon library up to version 1.9.13, allowing remote attackers to manipulate the filter argument in the makeCriteria function. Defenders should verify the library version used in their systems, prioritize patching or applying workarounds, and monitor for suspicious activity.

• Remote attackers can manipulate the filter argument to perform SQL injection attacks.
• Successful attacks may lead to unauthorized data access or modification.
• Defenders need to verify the version of drogon used in their systems and apply patches or workarounds.
• The exploit has been made public, increasing the risk of exploitation.

Technical summary

The SQL injection vulnerability exists in the makeCriteria function within the orm_lib/src/Criteria.cc file of the ORM component in drogonframework drogon up to version 1.9.13. This allows remote attackers to perform SQL injection attacks by manipulating the filter argument. The vulnerability can be exploited from remote locations, and the exploit has been made public. Defenders should prioritize verifying the version of drogon used in their systems and consider applying patches or workarounds to mitigate the SQL injection vulnerability.

Defensive priority

Defenders should prioritize verifying the version of drogon used in their systems and consider applying patches or workarounds to mitigate the SQL injection vulnerability.

Recommended defensive actions

• Verify the version of drogon used in your systems and update to a patched version if available.
• Implement input validation and sanitization for the filter argument to prevent SQL injection attacks.
• Monitor systems for suspicious activity related to the ORM component.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its existence in drogon up to version 1.9.13 and the potential for remote SQL injection attacks. However, specific details about affected or patched versions are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.