Vulnerability Database

313,825

Total vulnerabilities in the database

CVE-2016-10553

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.

Published: May 31, 2018
Updated: Nov 9, 2025
CVE: CVE-2016-10553
GHSA: GHSA-2v7q-2xqx-f4q5
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-89

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
sequelizejs / sequelize	-	2.1.3.x
sequelize	-	3.0.0

https://github.com/sequelize/sequelize/blob/master/changelog.md#300
https://nodesecurity.io/advisories/109
https://www.npmjs.com/advisories/109

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo