~ / search / GHSA-2598-2f59-rmhq

GHSA-2598-2f59-rmhq

SQL Injection in sequelize

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10749

Packages

EcosystemPackageAffectedFixed in
npm sequelize < 3.35.1 3.35.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `sequelize` prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. ## Recommendation Upgrade to version 3.35.1 or later.

References

External links from the advisory. They lead to third-party sites.