~ / search / GHSA-2777-2vq8-c4v4

GHSA-2777-2vq8-c4v4

SQL Injection in sequelize

Source: GitHub Advisory Database (reviewed) High CVE-2019-11069

Packages

EcosystemPackageAffectedFixed in
npm sequelize >= 5.0.0, < 5.3.0 5.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `sequelize` prior to 5.3.0 (excluding v3 and v4) are vulnerable to SQL Injection. PostgreSQL option`standard_conforming_strings` is not set to `on` by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals. ## Recommendation Upgrade to version 5.3.0 or later.

References

External links from the advisory. They lead to third-party sites.