GitHub Advisoryadvisory · npm

GHSA-98pq-pmw9-4gpm SQL Injection in sequelize

HIGH Published 2019-02-18 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10550
Ecosystem
npm
Packages
sequelize
Severity
High
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• npm sequelize: < 3.17.0 → fixed in 3.17.0

Description

Affected versions of `sequelize` are vulnerable to SQL Injection in locations where user input is passed into the `limit` or `order` parameters of `sequelize` query calls, such as `findOne` or `findAll`. Recommendation Update to version 3.17.0 or later.

Related

Alias · CVE (1)

  • CVE-2016-10550 sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References