GHSA-2598-2f59-rmhq

ghsaUSosv

SQL Injection in sequelize

view advisory published 2019-11-08Licence: CC-BY-4.0

Versions of `sequelize` prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. ## Recommendation Upgrade to version 3.35.1 or later.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-10749US	critical9.8	1.23% (69th)	—	2019-10-29
sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.

references

External citations — patches, advisories, analysis.

https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-10749ADVISORY
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222WEB
https://www.npmjs.com/advisories/1017WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan