Description
Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Sequelize | All versions prior to 3.35.1, All versions prior to 4.44.3, All versions prior to 5.8.11 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | sequelize | < 3.35.1 | 3.35.1 | GHSA-j9xp-92vc-559j |
| npm | sequelize | >= 4.0.0, < 4.44.3 | 4.44.3 | GHSA-j9xp-92vc-559j |
| npm | sequelize | >= 5.0.0, < 5.8.11 | 5.8.11 | GHSA-j9xp-92vc-559j |