Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2019-10748
9.8
CRITICALCVSS v3
Severity scale
010
Description
Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.
sequelize
NPMSequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.
NPMSequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.>= 4.0.0, < 4.44.3, >= 3.0.0, < 3.35.1, >= 5.0.0, <= 5.8.11NVD
@types/sequelizeNPMStub TypeScript definitions entry for sequelize, which provides its own types definitions
NPMStub TypeScript definitions entry for sequelize, which provides its own types definitions>= 4.0.0, < 4.44.3, >= 3.0.0, < 3.35.1, >= 5.0.0, <= 5.8.11NVD
GitHub