# CVE-2019-10749: Sequelize SQL injection in Postgres JSON path keys

Source: https://junglewise.ai/threats/cve-2019-10749-sequelize-sql-injection-in-postgres-json-path-keys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-11-08. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2019-10749 · Severity: low · CVSS 3.1 · Published 2019-11-08

Sequelize is a popular tool used by Node.js applications to communicate with databases. A security flaw in older versions allows attackers to bypass security protections and run unauthorized database commands when the application uses a PostgreSQL database. This could lead to the theft of sensitive customer data, unauthorized modification of records, or full database compromise.

Technologies: [sequelize (npm)](https://junglewise.ai/threats/technologies/sequelize). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-10749 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-10749 being exploited in the wild.

**How severe is CVE-2019-10749?** Low severity, with a CVSS score of 3.1, published 8 November 2019.

**Which products and versions are affected?** sequelize (npm) SEMVER:introduced=0,fixed=3.35.1.

**Is there a fix for CVE-2019-10749?** Yes. sequelize (npm): upgrade to 3.35.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-10749 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-10749?** Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sequelize (npm): upgrade to 3.35.1 or later

  ```sh
  npm install sequelize@3.35.1
  ```


## Technical details

A SQL injection vulnerability exists in Sequelize versions prior to 3.35.1 when using the PostgreSQL dialect. The root cause is the failure to properly sanitize or escape JSON path keys within the `query-generator.js` component. Specifically, the library incorrectly concatenated user-supplied JSON keys into SQL strings using the `#>>` operator. An attacker can provide a specially crafted JSON key containing SQL fragments (e.g., using single quotes and UNION statements) to break out of the intended query structure. This allows for unauthorized data retrieval or manipulation without requiring authentication, provided the application passes user-controlled JSON keys to Sequelize's query methods. The issue is fixed in version 3.35.1 by properly escaping the path keys.

## Affected products

- sequelizejs sequelize < 3.35.1

## Identifiers

- CVE-2019-10749
- GHSA-2598-2f59-rmhq

## Timeline

- 2019-06-20: disclosed: Vulnerability disclosed by Snyk Security Team
- 2019-06-20: patched: Fix committed to Sequelize repository
- 2019-10-29: advisory: NVD published CVE-2019-10749

## References

- [https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68](https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68)
- [https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222](https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222)
- [https://www.npmjs.com/advisories/1017](https://www.npmjs.com/advisories/1017)

## Related threats

- [Sequelize SQL injection in Oracle dialect escape function](https://junglewise.ai/threats/cve-2026-69240-sequelize-sql-injection-in-oracle-dialect-escape-function)
- [Sequelize SQL injection in JSON where clause processing](https://junglewise.ai/threats/cve-2026-30951-sequelize-sql-injection-in-json-where-clause-processing)
- [Sequelize SQL injection via unescaped parentheses in attributes](https://junglewise.ai/threats/cve-2023-22578-sequelize-sql-injection-via-unescaped-parentheses-in-attributes)
- [Sequelize unsafe fall-through in getWhereConditions](https://junglewise.ai/threats/cve-2023-22579-sequelize-unsafe-fall-through-in-getwhereconditions)
- [Sequelize SQL injection via replacements](https://junglewise.ai/threats/cve-2023-25813-sequelize-sql-injection-via-replacements)