Versions of sequelize prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as $gt are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection.

Recommendation

Upgrade to version 4.12.0 or later

References

• sequelize/sequelize#7310
• https://snyk.io/vuln/SNYK-JS-SEQUELIZE-174147
• sequelize/sequelize#8240
• sequelize/sequelize@ccb99da