CVE-2016-10554
SQL Injection in sequelize
EPSS 0.49%
Description
Affected versions of `sequelize` use MySQL's backslash-based escape syntax when connecting to SQLite, despite the fact that SQLite uses PostgreSQL's escape syntax, which can result in a SQL Injection vulnerability. ## Recommendation Update to version 1.7.0-alpha3 or later.
How to fix CVE-2016-10554
To remediate CVE-2016-10554, upgrade the affected package to a fixed version below.
- npm/sequelize—upgrade to 1.7.0 or later
Is CVE-2016-10554 being exploited?
Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 1.7.0