CVE-2019-10752 | BDVDB-2026-124683 Detail

sequelize

Description#

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/sequelize/sequelize/commit/9bd0bc1%2C
https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C

Exploit#

No public exploit known

History#

Version 12019-10-17Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.