CVE-2016-10553: SQL Injection
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-10553?
CVE-2016-10553 is a vulnerability in sequelize, a Node.js ORM library, that allows for potential SQL injection.
How severe is CVE-2016-10553?
CVE-2016-10553 has a severity rating of 9.8, which is considered critical.
What software is affected by CVE-2016-10553?
Sequelize versions up to and including 2.1.3 are affected by CVE-2016-10553.
How can I fix CVE-2016-10553?
To fix CVE-2016-10553, upgrade to a version of sequelize that is higher than 2.1.3.
Where can I find more information about CVE-2016-10553?
You can find more information about CVE-2016-10553 in the Sequelize changelog (https://github.com/sequelize/sequelize/blob/master/changelog.md#300) and on the Node Security Platform advisory (https://nodesecurity.io/advisories/109).