{"id":"CVE-2019-10749","aliases":["EUVD-2019-0721","GHSA-2598-2f59-rmhq","SNYK-JS-SEQUELIZE-450222"],"status":"published","title":"SQL Injection in sequelize","description":"sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01228,"percentile":0.69078,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2019-10-29T16:06:05Z","modified":"2026-10-20T10:50:37Z","fixes":[{"ecosystem":"npm","package":"sequelize","fixed_in":["3.35.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"sequelize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.35.1"}]}]},{"source":"osv","ecosystem":"npm","package":"sequelize","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.35.1"}]}]}],"products":[{"vendor":"sequelize","product":"sequelize"},{"vendor":"sequelizejs","product":"sequelize"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10749","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/1017","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2598-2f59-rmhq"}],"sources":{"cve":[{"id":"CVE-2019-10749","description":"sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.","status":"published","published":"2019-10-29T16:06:05Z","modified":"2024-08-04T22:32:01.594Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2019-0721","description":"sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.","status":"published","published":"2019-10-29T16:06:05Z","modified":"2024-08-04T22:32:01Z","updated_at":"2026-11-03T02:40:51.633398Z"}],"ghsa":[{"id":"GHSA-2598-2f59-rmhq","title":"SQL Injection in sequelize","description":"Versions of `sequelize` prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect,  which may allow attackers to inject SQL statements and execute arbitrary SQL queries.\n\n\n## Recommendation\n\nUpgrade to version 3.35.1 or later.","status":"published","published":"2019-11-08T17:05:17Z","modified":"2023-01-09T05:02:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2019-10749","description":"sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.","status":"published","published":"2019-10-29T19:15:16.75Z","modified":"2026-06-17T02:11:35.857Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:05:32.982925Z"}],"osv":[{"id":"CVE-2019-10749","description":"sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.","status":"published","published":"2019-10-29T19:15:16.75Z","modified":"2026-10-20T10:50:37.787074932Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-2598-2f59-rmhq","title":"SQL Injection in sequelize","description":"Versions of `sequelize` prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect,  which may allow attackers to inject SQL statements and execute arbitrary SQL queries.\n\n\n## Recommendation\n\nUpgrade to version 3.35.1 or later.","status":"published","published":"2019-11-08T17:05:17Z","modified":"2026-07-08T05:56:27.633137589Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:33.956911Z"}]}}