@loke/mysql-orm (1.12.0), bell.js (>=2.0.0-alpha.1, <=2.0.5) +37 more potentially affected by CVE-2016-10556 via sequelize (>=3.0.1, <=3.19.3)

sequelize NPM version =3.0.1, =2.0.0-alpha.1, =1.0.2, =0.1.0, =2.8.0, =0.0.1, =10.0.2, =0.0.1, =0.0.1, =0.1.0, =1.0.2, =0.0.1, =5.0.0-rc, =6.0.0-rc6 and more Source cves: CVE-2016-10556 Source advisory: OSV:GHSA-9C2P-JW8P-F84V...

CVE-2016-10556

CVE-2016-10556 affects the Sequelize ORM for Node.js (v3.19.3 and earlier). The issue: when an array is used as a string in a query, Sequelize incorrectly escapes it, causing a SQL injection in Postgres, SQLite, and MSSQL. The PoC shows a crafted replacements value leading to a query like: SELECT...