CVE-2026-63221

### Impact A SQL injection vulnerability exists in the Query Builder's `deleteBatch()` method. When `deleteBatch()` is used together with `where()` conditions, the bound values from the `WHERE` clause are substituted directly into the generated SQL **with their escape flag ignored**, so they are never escaped or quoted. If an application passes user-controlled input to `where()` before calling `deleteBatch()`, that input is interpreted as SQL rather than as a value, allowing SQL injection. This affects only the `deleteBatch()` code path. Regular `delete()` operations escape `where()` binds correctly. ### Patches Upgrade to v4.7.4 or later. ### Workarounds If you cannot upgrade immediately: - Strictly validate and cast values (e.g. numeric IDs) before using them in conditions - though this does not fully protect string conditions. - Do not pass user-controlled input to `where()` when using `deleteBatch()`. - For user-controlled conditions, use a normal `delete()` with Query Builder binds instead of `deleteBatch(`). - Where possible, express required matching values through the batch data and `onConstraint()` rather than as separate user-controlled `where()` clauses.