{"id":"GHSA-wfp9-vr4j-f49j","summary":"NoSQL Injection in sequelize","details":"Versions of `sequelize` prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as `$gt` are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection.\n\n\n## Recommendation\n\nUpgrade to version 4.12.0 or later","modified":"2023-04-21T19:34:39Z","published":"2019-06-04T20:04:27Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-89"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2019-06-04T20:04:00Z"},"references":[{"type":"WEB","url":"https://github.com/sequelize/sequelize/issues/7310"},{"type":"WEB","url":"https://github.com/sequelize/sequelize/pull/8240"},{"type":"WEB","url":"https://github.com/sequelize/sequelize/commit/ccb99daedb69e8750a241436415ccac8abef358d"},{"type":"PACKAGE","url":"https://github.com/sequelize/sequelize"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-SEQUELIZE-174147"}],"affected":[{"package":{"name":"sequelize","ecosystem":"npm","purl":"pkg:npm/sequelize"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.12.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-wfp9-vr4j-f49j/GHSA-wfp9-vr4j-f49j.json"}}],"schema_version":"1.9.0"}