GitHub Advisoryadvisory · npm

GHSA-x2jc-pwfj-h9p3 SQL Injection in sequelize

MEDIUM Published 2019-02-18 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10554
Ecosystem
npm
Packages
sequelize
Severity
Moderate
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• npm sequelize: < 1.7.0 → fixed in 1.7.0

Description

Affected versions of `sequelize` use MySQL's backslash-based escape syntax when connecting to SQLite, despite the fact that SQLite uses PostgreSQL's escape syntax, which can result in a SQL Injection vulnerability. Recommendation Update to version 1.7.0-alpha3 or later.

Related

Alias · CVE (1)

  • CVE-2016-10554 sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References