Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security ISSUE: SQL Injection] sequelize 4.44.* #11202

Closed
2 of 7 tasks
sahatnicholas-gdp opened this issue Jul 18, 2019 · 2 comments
Closed
2 of 7 tasks

[Security ISSUE: SQL Injection] sequelize 4.44.* #11202

sahatnicholas-gdp opened this issue Jul 18, 2019 · 2 comments

Comments

@sahatnicholas-gdp
Copy link

sahatnicholas-gdp commented Jul 18, 2019 •
edited

What are you doing?

Snyk reports a SQL injection vulnerability in version sequelize@4.44.*.

https://www.npmjs.com/advisories/1018

Would you help offering a solution or explanation to that? Currently, the only remedy is to upgrade sequelize to v5, which breaks a lot of my existing code.
Thanks before.

Environment

Dialect:

  • mysql
  • postgres
  • sqlite
  • mssql
  • any

Sequelize version: 4.44.*
Tested with latest release:

  • No
  • Yes, specify that version:
@sahatnicholas-gdp sahatnicholas-gdp changed the title [ Security ISSUE: SQL Injection] sequelize 4.44.* [Security ISSUE: SQL Injection] sequelize 4.44.* Jul 18, 2019
@sahatnicholas-gdp sahatnicholas-gdp mentioned this issue Jul 19, 2019
Closed
7 tasks
@papb
Copy link
Member

papb commented Jul 19, 2019

Thanks for reporting, PRs are welcome, unfortunately I don't have time to take a look into this right now...

@sushantdhiman sushantdhiman mentioned this issue Aug 18, 2019
Merged
6 tasks
@sushantdhiman
Copy link
Contributor

Fixed with #11332

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@sushantdhiman @sahatnicholas-gdp @papb