Most recent entries from all

bdu:2022-00005

2026-10-03T09:00:24.438166+00:00

bdu:2022-00005

EUVD-2026-53934

2026-10-03T09:00:24.438197+00:00

EUVD-2026-53934

fkie_cve-2019-10752

2026-10-03T09:00:24.438211+00:00

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.

GHSA-m9jw-237r-gvfv — SQL Injection in sequelize

2026-10-03T09:00:24.438239+00:00

Affected: npm: sequelize

Affected versions of `sequelize` are vulnerable to SQL Injection. The function `sequelize.json()` incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example:

```js return User.findAll({ where: this.sequelize.json("data.id')) AS DECIMAL) = 1 DELETE YOLO INJECTIONS; -- ", 1) }); ```

## Recommendation

If you are using `sequelize` 5.x, upgrade to version 5.15.1 or later. If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later.

gsd-2019-10752

2026-10-03T09:00:24.438269+00:00

gsd-2019-10752