CVE-2019-10748
CVE-2019-10748
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.
CVSS 9.8 · Critical · EPSS 1.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
sequelize
- Versions
- All versions prior to 3.35.1: Affected
- All versions prior to 4.44.3: Affected
- All versions prior to 5.8.11: Affected
No fix published
sequelize npm
- Affected ranges
- SEMVER: < 3.35.1
Update to 3.35.1
sequelize npm
- Affected ranges
- SEMVER: ≥ 4.0.0, < 4.44.3
Update to 4.44.3
sequelize npm
- Affected ranges
- SEMVER: ≥ 5.0.0, < 5.8.11
Update to 5.8.11