GitHub Advisoryadvisory · npm

GHSA-j9xp-92vc-559j SQL Injection in sequelize

CRITICAL Published 2019-11-06 Modified 2021-08-18 Official page ↗
Aliases
CVE-2019-10748
Ecosystem
npm
Packages
sequelize
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2019-11-05

Affected packages

• npm sequelize: < 3.35.1 → fixed in 3.35.1 • npm sequelize: >= 4.0.0, < 4.44.3 → fixed in 4.44.3 • npm sequelize: >= 5.0.0, < 5.8.11 → fixed in 5.8.11

Description

Affected versions of `sequelize` are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the MariaDB and MySQL dialects, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation If you are using `sequelize` 5.x, upgrade to version 5.8.11 or later. If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later. If you are using `sequelize` 3.x, upgrade to version 3.35.1 or later.

Related

Alias · CVE (1)

  • CVE-2019-10748 Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References