GitHub Advisoryadvisory · npm

GHSA-2598-2f59-rmhq SQL Injection in sequelize

CRITICAL Published 2019-11-08 Modified 2021-08-18 Official page ↗
Aliases
CVE-2019-10749
Ecosystem
npm
Packages
sequelize
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2019-11-07

Affected packages

• npm sequelize: < 3.35.1 → fixed in 3.35.1

Description

Versions of `sequelize` prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation Upgrade to version 3.35.1 or later.

Related

Alias · CVE (1)

  • CVE-2019-10749 sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References