p PatchFirst

CVE-2019-10752

CVE-2019-10752

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.

CVSS 9.8 · Critical · EPSS 1.5% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • sequelize

    Versions
    • All versions prior to version 4.44.3 and 5.15.1: Affected

    No fix published

  • sequelize npm

    Affected ranges
    • SEMVER: < 4.44.3

    Update to 4.44.3

  • sequelize npm

    Affected ranges
    • SEMVER: ≥ 5.0.0, < 5.15.1

    Update to 5.15.1

Original sources

Check your server →