CVE-2016-1000225
SQL Injection via GeoJSON in sequelize
CVE-2016-1000225 is a critical vulnerability (CVSS 9.8) in sequelize, published September 1, 2020. No source lists public exploit code. Fixed in sequelize 3.23.6.
- Severity
- 9.8 CriticalCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.23.6sequelize
Description
Affected versions of sequelize are vulnerable to SQL Injection in Models that have fields with the GEOMETRY DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using ST_GeomFromGeoJSON, and MySQL GeoJSON documents using GeomFromText.
Recommendation
Update to version 3.23.6 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sequelizenpm | 3.4.0 up to 3.23.6 | 3.23.6 |
What each source reports
GitHub Advisories Score usedGHSA-5v9h-q3gj-c32x
SQL Injection via GeoJSON in sequelize
Affected versions of sequelize are vulnerable to SQL Injection in Models that have fields with the GEOMETRY DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using ST_GeomFromGeoJSON, and MySQL GeoJSON documents using GeomFromText.
Recommendation
Update to version 3.23.6 or later.
- Record
GHSA-5v9h-q3gj-c32x- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-5v9h-q3gj-c32x
SQL Injection via GeoJSON in sequelize
Affected versions of sequelize are vulnerable to SQL Injection in Models that have fields with the GEOMETRY DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using ST_GeomFromGeoJSON, and MySQL GeoJSON documents using GeomFromText.
Recommendation
Update to version 3.23.6 or later.
- Record
GHSA-5v9h-q3gj-c32x- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/sequelize/sequelize/issues/6194
nvd.nist.gov/vuln/detail/CVE-2016-1000225
snyk.io/vuln/npm:sequelize:20160718
Show 5 moreShow less