Description
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
Remediation
References
https://github.com/sequelize/sequelize/commit/9bd0bc1%2C
https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541e
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751
Related Vulnerabilities
CVE-2018-3721 Vulnerability in maven package org.webjars.bower:lodash
CVE-2022-31108 Vulnerability in npm package mermaid
CVE-2021-41086 Vulnerability in npm package jsuites
CVE-2020-7709 Vulnerability in npm package json-pointer
CVE-2022-40955 Vulnerability in maven package org.apache.inlong:sort-connector-mysql-cdc