SQL Injection Vulnerability in Sequelize ORM for Node.js

CVE-2016-10556

What is CVE-2016-10556?

An SQL injection vulnerability exists in the Sequelize ORM, affecting versions up to 3.19.3. This flaw arises from improper handling of arrays treated as strings across various databases, including Postgres, MS SQL Server, and SQLite. It allows an attacker to manipulate SQL queries, potentially leading to unauthorized data modifications and deletions. For instance, a crafted input could exploit the vulnerability by including malicious SQL commands that execute unintended operations on the database. Organizations using affected versions of Sequelize should prioritize implementing the necessary patches to safeguard their applications.

References