SQL Injection in sequelize

GHSA-2598-2f59-rmhq · CVE-2019-10749 · SNYK-JS-SEQUELIZE-450222

Published Nov 8, 2019 · Modified Jul 8, 2026

Description

Versions of sequelize prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect, which may allow attackers to inject SQL statements and execute arbitrary SQL queries.

Recommendation

Upgrade to version 3.35.1 or later.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-10749
WEB https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68
WEB https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222
WEB https://www.npmjs.com/advisories/1017

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes