CVE-2016-10554: SQL Injection
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. Before version 1.7.0-alpha3, sequelize defaulted SQLite to use MySQL backslash escaping, even though SQLite uses Postgres escaping.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-10554?
CVE-2016-10554 is a vulnerability in sequelize, an Object-relational mapping tool for NodeJS, that allows for SQL injection attacks.
What is the severity of CVE-2016-10554?
CVE-2016-10554 has a severity rating of 9.8, which is considered critical.
How does CVE-2016-10554 affect my software?
If you are using sequelize version 1.6.0 or earlier, or version 1.7.0-alpha1 or 1.7.0-alpha2, your software is vulnerable to CVE-2016-10554.
How can I fix CVE-2016-10554?
You can fix CVE-2016-10554 by upgrading to version 1.7.0-alpha3 or later of sequelize.
Where can I find more information about CVE-2016-10554?
You can find more information about CVE-2016-10554 at the following references: [GitHub](https://github.com/sequelize/sequelize/commit/c876192aa6ce1f67e22b26a4d175b8478615f42d) and [Node Security](https://nodesecurity.io/advisories/113).