GitHub Advisoryadvisory · npm

GHSA-cgpp-wm2h-6hqx SQL Injection in waterline-sequel

HIGH Published 2019-02-18 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10551
Ecosystem
npm
Packages
waterline-sequel
Severity
High
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• npm waterline-sequel: < 0.5.1 → fixed in 0.5.1

Description

Affected versions of `waterline-sequel` are vulnerable to SQL injection in cases where user input is passed into the `like`, `contains`, `startsWith`, or `endsWith` methods. Recommendation Upgrade to at least version 0.5.1

Related

Alias · CVE (1)

  • CVE-2016-10551 waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`,… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References