Description
sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | sequelize | All versions prior to version 3.35.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | sequelize | < 3.35.1 | 3.35.1 | GHSA-2598-2f59-rmhq |