Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2019-10749
9.8
CRITICALCVSS v3
Severity scale
010
Description
sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
sequelize
NPMSequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.
NPMSequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.< 3.35.1NVD
@types/sequelizeNPMStub TypeScript definitions entry for sequelize, which provides its own types definitions
NPMStub TypeScript definitions entry for sequelize, which provides its own types definitions< 3.35.1NVD
GitHub