| Package | Affected versions | Patched versions |
|---|---|---|
| sequelize | ≥ 3.4.0, < 3.23.6 | 3.23.6 |
Affected versions of sequelize are vulnerable to SQL Injection in Models that have fields with the GEOMETRY DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using ST_GeomFromGeoJSON, and MySQL GeoJSON documents using GeomFromText.
Update to version 3.23.6 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free