CVE-2019-10752

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	sequelize	All versions prior to version 4.44.3 and 5.15.1

References

https://github.com/sequelize/sequelize/commit/9bd0bc1%2C
https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541ePatch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751Exploit, Third Party Advisory
https://github.com/sequelize/sequelize/commit/9bd0bc1%2C
https://github.com/sequelize/sequelize/commit/9bd0bc111b6f502223edf7e902680f7cc2ed541ePatch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-SEQUELIZE-459751%2C

Timeline

Published: Oct 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107535.9In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to versi CVE-2019-107548.1Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID genera CVE-2019-107554.9The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes t CVE-2019-107565.4It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw CVE-2019-107579.8knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, all CVE-2019-107589.9mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` depende CVE-2019-107599.9safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execut CVE-2019-10765.4A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foun CVE-2019-107609.9safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execut CVE-2019-107618.3This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" conte CVE-2019-107629.8columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.CVE-2019-107636.5pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL inje