CVE-2019-10752

critical

Description

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.

References

https://github.com/advisories/GHSA-m9jw-237r-gvfv

https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C

https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e

https://github.com/sequelize/sequelize/commit/9bd0bc1%2C

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0706

Details

Source: Mitre, NVD

Published: 2019-10-17

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.01462

Detections

Analytics