critical9.8
CVE-2016-10550
SQL Injection in sequelize
Impact
Affected versions of `sequelize` are vulnerable to SQL Injection in locations where user input is passed into the `limit` or `order` parameters of `sequelize` query calls, such as `findOne` or `findAll`. ## Recommendation Update to version 3.17.0 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | sequelize | < 3.17.0 | 3.17.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sequelizejs | Sequelize | through 3.16.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e57ecdb82adccb4eaef404f03
- https://nodesecurity.io/advisories/112
- https://github.com/advisories/GHSA-98pq-pmw9-4gpm
- https://nvd.nist.gov/vuln/detail/CVE-2016-10550
- https://www.npmjs.com/advisories/112