CVE-2016-10554

描述

Affected versions of `sequelize` use MySQL's backslash-based escape syntax when connecting to SQLite, despite the fact that SQLite uses PostgreSQL's escape syntax, which can result in a SQL Injection vulnerability. ## Recommendation Update to version 1.7.0-alpha3 or later.

如何修補 CVE-2016-10554

要修補 CVE-2016-10554,請將受影響套件升級到下列已修補版本。

• npm/sequelize—升級至 1.7.0 或更新版本

CVE-2016-10554 正在被利用嗎?

低 — EPSS 為 1.9%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.7.0

參考連結(4)

• ADVISORYgithub.com/advisories/GHSA-x2jc-pwfj-h9p3
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2016-10554
• WEBgithub.com/sequelize/sequelize/commit/c876192aa6ce1f67e22b26a4d175b8478615f42d
• WEBwww.npmjs.com/advisories/113