CriticalGHSA-j9xp-92vc-559jCVE-2019-10748SNYK-JS-SEQUELIZE-450221

SQL Injection in sequelize

Published 6 Nov 2019 · Updated 8 Jul 2026

Affected packages

sequelizenpm

Affected: <3.35.1
Fixed in: 3.35.1

Update to the fixed version for your release line, for example:npm install sequelize@3.35.1

sequelizenpm

Affected: >=4.0.0 <4.44.3
Fixed in: 4.44.3

Update to the fixed version for your release line, for example:npm install sequelize@4.44.3

sequelizenpm

Affected: >=5.0.0 <5.8.11
Fixed in: 5.8.11

Update to the fixed version for your release line, for example:npm install sequelize@5.8.11

Details

Affected versions of sequelize are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the MariaDB and MySQL dialects, which may allow attackers to inject SQL statements and execute arbitrary SQL queries.

Recommendation

If you are using sequelize 5.x, upgrade to version 5.8.11 or later. If you are using sequelize 4.x, upgrade to version 4.44.3 or later. If you are using sequelize 3.x, upgrade to version 3.35.1 or later.

Is GHSA-j9xp-92vc-559j in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected sequelize, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.