CVE-2019-10748

2019-10-2821:42:45

snyk

www.cve.org

AI Score

9.9

Confidence

High

EPSS

0.002

Percentile

56.0%

JSON

Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.

CNA Affected

[
  {
    "product": "Sequelize",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to 3.35.1"
      },
      {
        "status": "affected",
        "version": "All versions prior to 4.44.3"
      },
      {
        "status": "affected",
        "version": "All versions prior to 5.8.11"
      }
    ]
  }
]