NoSQL Injection in sequelize

GHSA-wfp9-vr4j-f49j

Published Jun 4, 2019 · Modified Apr 21, 2023

Description

Versions of sequelize prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as $gt are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection.

Recommendation

Upgrade to version 4.12.0 or later

References

WEB https://github.com/sequelize/sequelize/issues/7310
WEB https://github.com/sequelize/sequelize/pull/8240
WEB https://github.com/sequelize/sequelize/commit/ccb99daedb69e8750a241436415ccac8abef358d
PACKAGE https://github.com/sequelize/sequelize
WEB https://snyk.io/vuln/SNYK-JS-SEQUELIZE-174147

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes