Description
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
Remediation
References
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751
https://github.com/sequelize/sequelize/commit/9bd0bc1%2C
https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C
Related Vulnerabilities
CVE-2020-14968 Vulnerability in maven package org.webjars.bower:jsrsasign
CVE-2023-5572 Vulnerability in npm package @vrite/sdk
CVE-2023-40814 Vulnerability in maven package org.opencrx:opencrx-core-models
CVE-2022-3224 Vulnerability in maven package org.webjars.npm:parse-url
CVE-2020-23622 Vulnerability in maven package org.fourthline.cling:cling-core