Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Sequelize package can let attackers alter data

CVE-2019-10748 · published 2 days ago
Summary

The Sequelize library used in several Node.js projects has a flaw that could let a malicious user change or delete data they shouldn't control. It affects the wikirik/sequelize, sequelizejs/sequelize, sequelize, and @rootio/sequelize packages. Update to the latest patched version provided by Root to close the risk.

What to do
  • Update wikirik sequelize to version 3.35.1.
  • Update wikirik sequelize to version 4.44.3.
  • Update wikirik sequelize to version 5.8.11.
  • Update sequelize to version 4.44.3-aikido.1.
  • Update rootio @rootio/sequelize to version 4.44.3-root.io.1.
Affected software
Ecosystem VendorProductAffected versions
npm wikirik sequelize < 3.35.1
>= 4.0.0, < 4.44.3
>= 5.0.0, < 5.8.11
Fix: upgrade to 3.35.1
– sequelizejs sequelize >= 3.0.0, < 3.35.1
>= 4.0.0, < 4.44.3
>= 5.0.0, <= 5.8.11
cpe:2.3:a:sequelizejs:sequelize:*:*:*:*:*:node.js:*:*
Root:npm – sequelize < 4.44.3-aikido.1
Fix: upgrade to 4.44.3-aikido.1
Root:npm rootio @rootio/sequelize < 4.44.3-root.io.1
Fix: upgrade to 4.44.3-root.io.1
Original advisory text
CVE-2019-10748 in sequelize - Patched by Root
Root has patched CVE-2019-10748 in the sequelize package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published6 Nov 2026
Updated8 Nov 2026
First seen6 Mar 2026
Sources
GHSA-j9xp-92vc-559j · GHSA
CVE-2019-10748 · NVD
ROOT-APP-NPM-CVE-2019-10748 · OSV
Track software like this
Free during beta