Potential SQL Injection in sequelize
Published 18 Feb 2019 · Updated 8 Nov 2023
Affected package
- Affected
- <3.0.0
- Fixed in
- 3.0.0
npm install sequelize@3.0.0Details
Affected versions of sequelize are vulnerable to SQL Injection when user input is passed into findOne or into a statement such as where: "user input".
Recommendation
Update to version 3.0.0 or later.
Version 3.0.0 will introduce a number of breaking changes. Thankfully, the project authors have provided a 2.x -> 3.x upgrade guide to ease this transition.
If upgrading is not an option, it is also possible to mitigate this by ensuring that all uses of where: "input" and findOne("input") are properly sanitized, such as by the use of a wrapper function.
Is GHSA-2v7q-2xqx-f4q5 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected sequelize, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.