CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-10748
Critical (9.8) in sequelizejs sequelize. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in sequelize 3.35.1, 4.44.3, 5.8.11.
Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sequelizejs:sequelize
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j9xp-92vc-559j | npm | sequelize | <3.35.1 | 3.35.1 |
| GHSA-j9xp-92vc-559j | npm | sequelize | >=4.0.0 <4.44.3 | 4.44.3 |
| GHSA-j9xp-92vc-559j | npm | sequelize | >=5.0.0 <5.8.11 | 5.8.11 |