CVE-2019-10749: SQL Injection in sequelize
Summary
CVE-2019-10749: SQL Injection in sequelize. Affects sequelize versions < 3.35.1. Fixed in 3.35.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sequelize is an Object-Relational Mapping (ORM) library for Node.js that provides easy access to databases by mapping database entries to JavaScript objects. It is commonly used for building web applications and APIs. Versions of Sequelize prior to 3.35.1 are vulnerable to SQL Injection. This vulnerability arises from the package's failure to properly sanitize JSON path keys in the Postgres dialect. As a result, attackers can inject SQL statements and execute arbitrary SQL queries.
Vulnerability Detail
The SQL Injection vulnerability in Sequelize allows attackers to manipulate database queries by injecting malicious SQL code. By exploiting this vulnerability, an attacker can potentially access, modify, or delete sensitive data, execute unauthorized actions, or even take control of the entire database. This vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
Latest published version: 6.37.8 as of 23 Oct 2026
npm install sequelize@6.37.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.35.1
This is the first release that contains the fix.
npm install sequelize@3.35.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of Sequelize to mitigate the risk of SQL Injection.
Conclusion
The SQL Injection vulnerability in Sequelize (CVE-2019-10749) poses a critical risk to applications using vulnerable versions of the package. To mitigate this risk, it is essential to upgrade to version 3.35.1 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sequelize →
FAQ
Sequelize is an Object-Relational Mapping (ORM) library for Node.js that simplifies database access and manipulation by mapping database entries to JavaScript objects.
SQL Injection is a type of vulnerability that occurs when an attacker is able to manipulate a database query by injecting malicious SQL code. This can lead to unauthorized access, data manipulation, or even complete control of the database.
Exploiting this vulnerability can allow attackers to execute arbitrary SQL queries, potentially accessing, modifying, or deleting sensitive data. It can also lead to unauthorized actions and compromise the security and integrity of the affected database.
Yes, upgrading to version 3.35.1 or later of Sequelize fixes this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the only recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for sequelize.
