CVE-2019-10748

Summary

CVE	CVE-2019-10748
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-10-29 19:15:00 UTC
Updated	2023-11-07 03:02:00 UTC
Description	Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.

Risk And Classification

Problem Types: CWE-89

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Sequelizejs	Sequelize	All	All	All	All
Application	Sequelizejs	Sequelize	All	All	All	All
Application	Sequelizejs	Sequelize	All	All	All	All

References

Reference	Source	Link	Tags
github.com/sequelize/sequelize/commit/a72a3f5%2C		github.com
github.com/sequelize/sequelize/pull/11089%2C		github.com
SQL Injection in sequelize \| Snyk	MISC	snyk.io	Exploit, Third Party Advisory
github.com/sequelize/sequelize/pull/11089,	MISC	github.com	Third Party Advisory
github.com/sequelize/sequelize/commit/a72a3f5,	MISC	github.com	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

981633 Nodejs (npm) Security Update for sequelize (GHSA-j9xp-92vc-559j)