# CVE-2015-1369: Sequelize SQL injection in order parameter

Source: https://junglewise.ai/threats/cve-2015-1369-sequelize-sql-injection-in-order-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-10-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2015-1369 · Severity: info · CVSS 7.5 · Published 2017-10-24

Sequelize is a popular Node.js ORM library used to manage database interactions in web applications. A SQL injection vulnerability in versions 2.0.0-rc7 and earlier allows attackers to inject arbitrary SQL commands through the order parameter, potentially enabling data theft, modification, or deletion of database records when user input is passed directly to query ordering functions.

Technologies: [sequelize (npm)](https://junglewise.ai/threats/technologies/sequelize). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2015-1369 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-1369 being exploited in the wild.

**How severe is CVE-2015-1369?** Informational severity, with a CVSS score of 7.5, published 24 October 2017.

**Which products and versions are affected?** sequelize (npm) SEMVER:introduced=0,fixed=2.0.0-rc8.

**Is there a fix for CVE-2015-1369?** Yes. sequelize (npm): upgrade to 2.0.0-rc8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-1369 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2015-1369?** Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sequelize (npm): upgrade to 2.0.0-rc8 or later

  ```sh
  npm install sequelize@2.0.0-rc8
  ```


## Technical details

This vulnerability is a SQL injection flaw in Sequelize's query builder that occurs when unsanitized user input is passed into the order parameter of finder methods such as findAndCountAll(). The root cause is insufficient input validation on the sort direction values. An attacker can craft malicious input (e.g., 'DESC; delete from test;') in the order array to inject arbitrary SQL commands. The vulnerability requires the attacker to control the order parameter value, typically through API parameters or user-controlled input in a web application. Successful exploitation allows arbitrary SQL execution with the database user's privileges. The vulnerability was fixed in version 2.0.0-rc8 and later.

## Affected products

- Sequelize Sequelize 2.0.0-rc7 and earlier

## Identifiers

- CVE-2015-1369
- GHSA-xqg8-cv3h-xppv

## Timeline

- 2015-01-12: disclosed: SQL injection vulnerability reported in GitHub issue #2906
- 2015-01-23: patched: Fixed in version 2.0.0-rc8

## References

- [https://github.com/sequelize/sequelize/issues/2906](https://github.com/sequelize/sequelize/issues/2906)

## Related threats

- [Sequelize SQL injection in Oracle dialect escape function](https://junglewise.ai/threats/cve-2026-69240-sequelize-sql-injection-in-oracle-dialect-escape-function)
- [Sequelize SQL injection in JSON where clause processing](https://junglewise.ai/threats/cve-2026-30951-sequelize-sql-injection-in-json-where-clause-processing)
- [Sequelize SQL injection via unescaped parentheses in attributes](https://junglewise.ai/threats/cve-2023-22578-sequelize-sql-injection-via-unescaped-parentheses-in-attributes)
- [Sequelize unsafe fall-through in getWhereConditions](https://junglewise.ai/threats/cve-2023-22579-sequelize-unsafe-fall-through-in-getwhereconditions)
- [Sequelize SQL injection via replacements](https://junglewise.ai/threats/cve-2023-25813-sequelize-sql-injection-via-replacements)