{
"id": "GHSA-2777-2vq8-c4v4",
"aliases": [
"CVE-2019-11069"
],
"details": "Versions of `sequelize` prior to 5.3.0 (excluding v3 and v4) are vulnerable to SQL Injection. PostgreSQL option`standard_conforming_strings` is not set to `on` by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals.\n\n\n## Recommendation\n\nUpgrade to version 5.3.0 or later.",
"summary": "SQL Injection in sequelize",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.3.0"
}
]
}
],
"package": {
"name": "sequelize",
"ecosystem": "npm"
}
}
],
"modified": "2023-11-20T22:07:00Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"published": "2019-04-11T16:33:17Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11069",
"type": "ADVISORY"
},
{
"url": "https://github.com/sequelize/sequelize/pull/10746",
"type": "WEB"
},
{
"url": "https://github.com/sequelize/sequelize/pull/10746/files",
"type": "WEB"
},
{
"url": "https://github.com/sequelize/sequelize/commit/850c7fd04669e0fef9238b6dc4f8d6ee93ed71e9",
"type": "WEB"
},
{
"url": "https://github.com/sequelize/sequelize",
"type": "PACKAGE"
},
{
"url": "https://github.com/sequelize/sequelize/blob/98cb17c17f73e2aa1792aa5a1d31216ba984b456/lib/dialects/postgres/connection-manager.js#L158-L160",
"type": "WEB"
},
{
"url": "https://github.com/sequelize/sequelize/releases/tag/v5.3.0",
"type": "WEB"
},
{
"url": "https://snyk.io/vuln/SNYK-JS-SEQUELIZE-174167",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2019-04-10T21:29:01Z",
"github_reviewed_at": "2020-06-16T20:51:40Z"
}
}