Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2019-10752
9.8
CRITICALCVSS v3
Severity scale
010
Description
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
sequelize
NPMSequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.
NPMSequelize is a promise-based Node.js ORM tool for Postgres, MySQL, MariaDB, SQLite, Microsoft SQL Server, Amazon Redshift and Snowflake’s Data Cloud. It features solid transaction support, relations, eager and lazy loading, read replication and more.>= 5.0.0, < 5.15.1, >= 4.0.0, < 4.44.3NVD
@types/sequelizeNPMStub TypeScript definitions entry for sequelize, which provides its own types definitions
NPMStub TypeScript definitions entry for sequelize, which provides its own types definitions>= 5.0.0, < 5.15.1, >= 4.0.0, < 4.44.3NVD
GitHub