HighGHSA-2777-2vq8-c4v4CVE-2019-11069
SQL Injection in sequelize
Published 11 Apr 2019 · Updated 20 Nov 2023
Affected package
sequelizenpm
- Affected
- >=5.0.0 <5.3.0
- Fixed in
- 5.3.0
Update to the fixed version for your release line, for example:
npm install sequelize@5.3.0Details
Versions of sequelize prior to 5.3.0 (excluding v3 and v4) are vulnerable to SQL Injection. PostgreSQL optionstandard_conforming_strings is not set to on by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals.
Recommendation
Upgrade to version 5.3.0 or later.
Is GHSA-2777-2vq8-c4v4 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected sequelize, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2019-11069
- Linkgithub.com/sequelize/sequelize/pull/10746
- Linkgithub.com/sequelize/sequelize/pull/10746/files
- Linkgithub.com/sequelize/sequelize/commit/850c7fd04669e0fef9238b6dc4f8d6ee93ed71e9
- Packagegithub.com/sequelize/sequelize
- Linkgithub.com/sequelize/sequelize/blob/98cb17c17f73e2aa1792aa5a1d31216ba984b456/lib/dialects/postgres/connection-manager.js#L158-L160
- Linkgithub.com/sequelize/sequelize/releases/tag/v5.3.0
- Linksnyk.io/vuln/SNYK-JS-SEQUELIZE-174167
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.