CVE-2016-10550: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

February 18, 2019 (updated January 8, 2021)

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the limit or order parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.

References

github.com/advisories/GHSA-98pq-pmw9-4gpm
github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e57ecdb82adccb4eaef404f03
nodesecurity.io/advisories/112
nvd.nist.gov/vuln/detail/CVE-2016-10550
www.npmjs.com/advisories/112

Code Behaviors & Features

Detect and mitigate CVE-2016-10550 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →