SQLite Escaping Issue in Sequelize ORM for NodeJS Applications
CVE-2016-10554

9.8CRITICAL

Key Information:

Vendor

Hackerone

Status
Sequelize Node Module
Vendor
CVE Published:
31 May 2018

What is CVE-2016-10554?

Sequelize, an ORM for NodeJS, exhibited a vulnerability where it incorrectly used MySQL backslash escaping for SQLite before version 1.7.0-alpha3. This misconfiguration could lead to potential data integrity issues, as it does not adhere to the expected escaping method for SQLite, which uses Postgres escaping. Developers using this version should update to ensure proper data handling and to mitigate potential security risks.

Affected Version(s)

sequelize node module <= 1.7.0-alpha2

References

https://github.com/sequelize/sequelize/commit/c876192aa6c...
x_refsource_MISC
https://nodesecurity.io/advisories/113
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2016-10554 : SQLite Escaping Issue in Sequelize ORM for NodeJS Applications