CVE-2019-10749

CRITICAL

sequelize < 3.35.1 - SQL Injection via Postgres JSON Path Keys

Title source: llm

Description

sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_misc

https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222

Patch x_refsource_misc

https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68

View Patch ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0123

EPSS Percentile 65.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (2)

npm/sequelize 0 - 3.35.1npm

sequelizejs/sequelize < 3.35.1

Published Oct 29, 2019

Tracked Since Feb 18, 2026