~ / search / GHSA-j9xp-92vc-559j

GHSA-j9xp-92vc-559j

SQL Injection in sequelize

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10748

Packages

EcosystemPackageAffectedFixed in
npm sequelize < 3.35.1 3.35.1
npm sequelize >= 4.0.0, < 4.44.3 4.44.3
npm sequelize >= 5.0.0, < 5.8.11 5.8.11

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of `sequelize` are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the MariaDB and MySQL dialects, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. ## Recommendation If you are using `sequelize` 5.x, upgrade to version 5.8.11 or later. If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later. If you are using `sequelize` 3.x, upgrade to version 3.35.1 or later.

References

External links from the advisory. They lead to third-party sites.