CVE-2016-1000225

The connected advisories identify a SQL Injection vulnerability in Sequelize involving models with the GEOMETRY DataType and GeoJSON handling. Specifically, unescaped single quotes in GeoJSON documents processed by ST_GeomFromGeoJSON (and GeomFromText for MySQL) allow injection in affected models...

@loke/mysql-orm (1.12.0), @starboard/models (>=3.0.0, <=3.0.1) +51 more potentially affected by CVE-2016-1000225 via sequelize (>=3.4.1, <=3.23.4)

sequelize NPM version =3.4.1, =3.0.0, =2.0.2, =0.0.1, =0.0.1, =2.0.0-alpha.1, =1.0.2, =0.1.0, =2.8.0, =0.0.1, =10.0.2, =1.0.1, =0.5.2, =0.0.1, =1.2.7 and more Source cves: CVE-2016-1000225 Source advisory: OSV:GHSA-5V9H-Q3GJ-C32X...