CVE-2016-1000225: SQL Injection via GeoJSON in sequelize
Summary
CVE-2016-1000225: SQL Injection via GeoJSON in sequelize. Affects sequelize versions >= 3.4.0, < 3.23.6. Fixed in 3.23.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Sequelize is an open-source Object-Relational Mapping (ORM) library for Node.js. It provides an easy-to-use interface for interacting with databases, allowing developers to define models and perform database operations using JavaScript. However, certain versions of Sequelize are vulnerable to SQL Injection when working with models that have fields using the GEOMETRY DataType. This vulnerability arises due to the lack of proper escaping of single quotes in GeoJSON documents, specifically when using the ST_GeomFromGeoJSON and GeomFromText functions in MySQL.
Vulnerability Detail
The SQL Injection vulnerability in Sequelize allows an attacker to manipulate database queries by injecting malicious SQL code through user-controlled input. In this case, the vulnerability affects models with fields using the GEOMETRY DataType, which are not properly escaped for GeoJSON documents. By exploiting this vulnerability, an attacker could execute arbitrary SQL queries, potentially leading to unauthorized data access, data manipulation, or even remote code execution. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 6.37.8 as of 23 Oct 2026
npm install sequelize@6.37.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.23.6
This is the first release that contains the fix.
npm install sequelize@3.23.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Sequelize to the latest version is not immediately feasible, a possible workaround is to manually escape single quotes in user-controlled input before using it in queries. This can be achieved by replacing single quotes with double single quotes ('') or using appropriate escaping functions provided by the database engine. However, this workaround is not recommended as it may introduce human error and is not a comprehensive solution. It is strongly advised to update to the latest version of Sequelize as soon as possible.
Conclusion
In conclusion, the vulnerability in Sequelize allows for SQL Injection via GeoJSON in models with fields using the GEOMETRY DataType. It is crucial to update to version 3.23.6 or later of Sequelize to mitigate this vulnerability. Developers should also ensure that user-controlled input is properly escaped to prevent SQL Injection attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sequelize →
FAQ
Sequelize is an open-source Object-Relational Mapping (ORM) library for Node.js. It provides an easy-to-use interface for interacting with databases using JavaScript.
SQL Injection is a type of security vulnerability where an attacker can manipulate database queries by injecting malicious SQL code through user-controlled input. This can lead to unauthorized data access, data manipulation, or even remote code execution.
This vulnerability affects certain versions of Sequelize that have models with fields using the GEOMETRY DataType. It allows an attacker to perform SQL Injection by exploiting the lack of proper escaping of single quotes in GeoJSON documents.
By exploiting this vulnerability, an attacker could execute arbitrary SQL queries, potentially leading to unauthorized data access, data manipulation, or even remote code execution.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for sequelize.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
