Package Instance

Unsafe fall-through in getWhereConditions
Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.

SQL Injection
sequelize is vulnerable to SQLi allowing attackers to delete data in the `TestTable` table.

Sequelize information disclosure vulnerability
Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.

SQL Injection via GeoJSON
SequelizeJS is vulnerable to SQL injection via GeoJSON documents containing a value with a single quote. This vulnerability affects postresql/postgis as well as MySQL.

NoSQL Injection in sequelize
Versions of `sequelize` prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as `$gt` are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection.


## Recommendation

Upgrade to version 4.12.0 or later

SQL Injection via GeoJSON
SequelizeJS 3.23.4 is vulnerable to SQL injection via GeoJSON documents containing a value with a single quote.  This vulnerability affects postresql/postgis as well as MySQL. This vulnerability only exists within GeoJSON documents using the function `ST_GeomFromGeoJSON` for postgresql/postgis and the function `GeomFromText` for mysql. SequelizeJS's `geometry` datatype is vulnerable.  If you have SequelizeJS models with a field that has a datatype of 'Geometry' and run a mysql or postgresql/postgis backend, your application is vulnerable

SequelizeJS is a popular ORM (Object Relational Mapper) for node.  

GeoJSON is a format for encoding a variety of geographic data structures.

Denial of Service in sequelize
Versions of `sequelize` prior to 4.44.4 are vulnerable to Denial of Service (DoS). The SQLite dialect fails to catch a `TypeError` exception for the `results` variable. The `results` value may be undefined and trigger the error on a `.map` call. This may allow attackers to submit malicious input that forces the exception and crashes the Node process.  

The following proof-of-concept crashes the Node process:  
```
const Sequelize = require('sequelize');

const sequelize = new Sequelize({
	dialect: 'sqlite',
	storage: 'database.sqlite'
});

const TypeError = sequelize.define('TypeError', {
	name: Sequelize.STRING,
});

TypeError.sync({force: true}).then(() => {
	return TypeError.create({name: "SELECT tbl_name FROM sqlite_master"});
});
```


## Recommendation

Upgrade to version 4.44.4 or later.

Improper Escaping of Bound Arrays
In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped.

Sequelize vulnerable to SQL Injection via replacements
Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fixed in Sequelize 6.19.1. Users are advised to upgrade. Users unable to upgrade should not use the `replacements` and the `where` option in the same query.