alke (>=0.0.1, <=0.0.2), audit.sequelize (0.0.1) +21 more potentially affected by CVE-2016-10554 via sequelize (>=1.0.2, <=1.6.0-beta4)

sequelize NPM version =1.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.7, =0.5.0-beta.2, =0.1.2, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.0.3, =0.1.0, =0.1.2 and more Source cves: CVE-2016-10554 Source advisory: OSV:GHSA-X2JC-PWFJ-H9P3...

CVE-2016-10554

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. Before version 1.7.0-alpha3, sequelize defaulted SQLite to use MySQL backslash escaping, even though SQLite uses Postgres escapin...

CVE-2016-10554

The CVE concerns sequelize (Node.js ORM). Before 1.7.0-alpha3, sequelize defaults SQLite to MySQL backslash escaping, even though SQLite uses PostgreSQL escaping, creating a SQL injection risk when Sequelize connects to SQLite. Affected: sequelize versions prior to 1.7.0-alpha3. Root cause: escap...