CVE-2016-10554: SQL Injection in sequelize

sequelize Updated 02 Oct 2025

Summary

18/02/2019

Disclosed on

CVE-2016-10554

CVE

Yes i

Fix available

Moderate

Severity

Not published

CVSS Score

CVE-2016-10554: SQL Injection in sequelize. Affects sequelize versions < 1.7.0. Fixed in 1.7.0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Sequelize is an Object-Relational Mapping (ORM) library for Node.js that provides an easy-to-use interface for interacting with databases. It supports multiple database systems, including MySQL and SQLite. The vulnerability in Sequelize arises from the incorrect handling of escape syntax when connecting to SQLite. Despite SQLite using PostgreSQL's escape syntax, Sequelize uses MySQL's backslash-based escape syntax, which can lead to a SQL Injection vulnerability.

Vulnerability Detail

The SQL Injection vulnerability in Sequelize allows an attacker to manipulate SQL queries by injecting malicious input. This can lead to unauthorized access, data leakage, or even complete compromise of the database. By exploiting this vulnerability, an attacker can execute arbitrary SQL statements, bypass authentication mechanisms, or retrieve sensitive information from the database.

How To Fix

Minimum fixed version

1.7.0

This is the first release that contains the fix.

npm install sequelize@1.7.0

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability.

Conclusion

The SQL Injection vulnerability in Sequelize can be mitigated by updating to the recommended version. It is important to promptly address this vulnerability to prevent potential unauthorized access or data leakage. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for sequelize →