GitHub Advisoryadvisory · npm

GHSA-2777-2vq8-c4v4 SQL Injection in sequelize

HIGH Published 2019-04-11 Modified 2023-11-20 Official page ↗
Aliases
CVE-2019-11069
Ecosystem
npm
Packages
sequelize
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• npm sequelize: >= 5.0.0, < 5.3.0 → fixed in 5.3.0

Description

Versions of `sequelize` prior to 5.3.0 (excluding v3 and v4) are vulnerable to SQL Injection. PostgreSQL option`standard_conforming_strings` is not set to `on` by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals. Recommendation Upgrade to version 5.3.0 or later.

Related

Alias · CVE (1)

  • CVE-2019-11069 Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References