CVEvulnerability
CVE-2019-10752
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-10-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
Affected configurations
• sequelizejs sequelize (>= 4.0.0 < 4.44.3)
• sequelizejs sequelize (>= 5.0.0 < 5.15.1)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://github.com/sequelize/sequelize/commit/9bd0bc1%2C github.com
- https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C snyk.io
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751 Exploit, Third Party Advisory
- https://github.com/sequelize/sequelize/commit/9bd0bc1%2C github.com
- https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C snyk.io