Description
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
Remediation
References
https://github.com/sequelize/sequelize/commit/9bd0bc1%2C
https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751
Related Vulnerabilities
CVE-2021-22204 Vulnerability in npm package exiftool-vendored
CVE-2021-39151 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2018-8039 Vulnerability in maven package org.apache.cxf:cxf-rt-transports-http
CVE-2012-0803 Vulnerability in maven package org.apache.cxf:cxf-bundle
CVE-2019-9153 Vulnerability in maven package org.webjars.npm:openpgp