CVE-2019-10752 Vulnerability in npm package sequelize

Description

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.

Remediation

References

https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751

https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e

https://github.com/sequelize/sequelize/commit/9bd0bc1%2C

https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C

Related Vulnerabilities

CVE-2020-7622 Vulnerability in maven package io.jooby:jooby-netty

CVE-2018-3728 Vulnerability in maven package org.webjars.npm:hoek

CVE-2017-16145 Vulnerability in npm package sspa

CVE-2022-40764 Vulnerability in npm package snyk

CVE-2020-26291 Vulnerability in npm package urijs

Severity

Critical

Classification

CWE-89 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H