CVE-2019-11069: Input Validation
Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.
Other sources
Versions of sequelize prior to 5.3.0 (excluding v3 and v4) are vulnerable to SQL Injection. PostgreSQL optionstandardconformingstrings is not set to on by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals.
Recommendation
Upgrade to version 5.3.0 or later.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-11069.
What is the severity rating of CVE-2019-11069?
The severity rating of CVE-2019-11069 is 7.5 (High).
Which software versions are affected by this vulnerability?
Versions of `sequelize` prior to 5.3.0 (excluding v3 and v4) are affected by this vulnerability.
What is the recommended fix for CVE-2019-11069?
To fix CVE-2019-11069, update `sequelize` to version 5.3.0 or newer.
Is there any additional information available about this vulnerability?
Yes, more information is available at the following references: - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-11069) - [GitHub](https://github.com/sequelize/sequelize/pull/10746) - [Snyk](https://snyk.io/vuln/SNYK-JS-SEQUELIZE-174167)