p PatchFirst

CVE-2019-10749

CVE-2019-10749

This page contains facts from public vulnerability sources. Check the original advisory before updating.

sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.

CVSS 9.8 · Critical · EPSS 1.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • sequelize

    Versions
    • All versions prior to version 3.35.1: Affected

    No fix published

  • sequelize npm

    Affected ranges
    • SEMVER: < 3.35.1

    Update to 3.35.1

Original sources

Check your server →