CriticalGHSA-5v9h-q3gj-c32xCVE-2016-1000225
SQL Injection via GeoJSON in sequelize
Published 1 Sept 2020 · Updated 8 Nov 2023
Affected package
sequelizenpm
- Affected
- >=3.4.0 <3.23.6
- Fixed in
- 3.23.6
Update to the fixed version for your release line, for example:
npm install sequelize@3.23.6Details
Affected versions of sequelize are vulnerable to SQL Injection in Models that have fields with the GEOMETRY DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using ST_GeomFromGeoJSON, and MySQL GeoJSON documents using GeomFromText.
Recommendation
Update to version 3.23.6 or later.
Is GHSA-5v9h-q3gj-c32x in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected sequelize, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2016-1000225
- Linkgithub.com/sequelize/sequelize/issues/6194
- Linkgithub.com/sequelize/sequelize/pull/6302
- Linkgithub.com/sequelize/sequelize/pull/6306
- Linkgithub.com/sequelize/sequelize/commit/14e3deaf3ad27f12900e5275db1d448844c9de3e
- Linkgithub.com/sequelize/sequelize/commit/18ac91040d9c57351d26ba998f460e214255b704
- Linkgithub.com/sequelize/sequelize/commit/562d52585902090f4e53eb21c61314098c29d795
- Linkgithub.com/sequelize/sequelize/commit/f93af43a1d86400487f5e3d9762f1a4b7cf6b1e1
- Packagegithub.com/sequelize/sequelize
- Linksnyk.io/vuln/npm:sequelize:20160718
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.