SQL Injection Affecting sequelize package, versions >=5.0.0-0 <5.3.0
Threat Intelligence
EPSS
0.2% (59th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-SEQUELIZE-174167
- published 11 Apr 2019
- disclosed 10 Apr 2019
- credit Unknown
Introduced: 10 Apr 2019
CVE-2019-11069 Open this link in a new tabHow to fix?
Upgrade sequelize to version 5.3.0 or higher.
Overview
sequelize is a promise-based Node.js ORM for Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server.
Affected versions of this package are vulnerable to SQL Injection due to lack of ensuring that standard conforming strings are used.
References
CVSS Scores
version 3.1