CVE-2019-10749: SQL Injection
sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-10749?
CVE-2019-10749 is a vulnerability in the sequelize library before version 3.35.1 that allows attackers to perform a SQL injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
What is the severity of CVE-2019-10749?
The severity of CVE-2019-10749 is critical with a base score of 9.8.
How does CVE-2019-10749 affect sequelize?
CVE-2019-10749 affects sequelize before version 3.35.1.
How can I fix CVE-2019-10749?
To fix CVE-2019-10749, you should update sequelize to version 3.35.1 or later.
Where can I find more information about CVE-2019-10749?
You can find more information about CVE-2019-10749 at the following references: [Github](https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68) and [Snyk](https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222).