GitHub Advisoryadvisory · npm

GHSA-wfp9-vr4j-f49j NoSQL Injection in sequelize

HIGH Published 2019-06-04 Modified 2023-04-21 Official page ↗
Ecosystem
npm
Packages
sequelize
Severity
High
Weaknesses
CWE-89
Reviewed
2019-06-04

Affected packages

• npm sequelize: < 4.12.0 → fixed in 4.12.0

Description

Versions of `sequelize` prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as `$gt` are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection. Recommendation Upgrade to version 4.12.0 or later

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References