# CVE-2016-10553: Sequelize SQL injection in findOne and where clauses

Source: https://junglewise.ai/threats/cve-2016-10553-sequelize-sql-injection-in-findone-and-where-clauses  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-02-18. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2016-10553 · Severity: info · CVSS 9.8 · Published 2019-02-18

Sequelize, a popular database tool for Node.js, is vulnerable to SQL injection. This flaw allows attackers to bypass security measures and interact directly with the underlying database by providing malicious input to specific search functions. An exploit could lead to unauthorized data access, modification of records, or complete database compromise.

Technologies: [sequelize (npm)](https://junglewise.ai/threats/technologies/sequelize). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2016-10553 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-10553 being exploited in the wild.

**How severe is CVE-2016-10553?** Informational severity, with a CVSS score of 9.8, published 18 February 2019.

**Which products and versions are affected?** sequelize (npm) SEMVER:introduced=0,fixed=3.0.0.

**Is there a fix for CVE-2016-10553?** Yes. sequelize (npm): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-10553 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-10553?** Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sequelize (npm): upgrade to 3.0.0 or later

  ```sh
  npm install sequelize@3.0.0
  ```


## Technical details

Sequelize versions 2.1.3 and earlier are vulnerable to SQL injection (CWE-89). The vulnerability occurs when untrusted user input is passed directly into the `findOne` method or into a `where` clause (e.g., `where: "user input"`). Because the library fails to properly neutralize special SQL elements in these specific contexts, a remote attacker can inject arbitrary SQL commands. This can be exploited over the network without authentication to read, modify, or delete data across various supported databases including MySQL, Postgres, and SQLite. The issue is resolved in version 3.0.0, which introduces breaking changes to how queries are handled.

## Affected products

- sequelizejs sequelize <= 2.1.3

## Identifiers

- CVE-2016-10553
- GHSA-2v7q-2xqx-f4q5

## Timeline

- 2016-10-05: disclosed: Vulnerability identified/reported via HackerOne
- 2018-05-31: advisory: NVD published CVE-2016-10553
- 2019-02-18: advisory: GitHub Advisory published GHSA-2v7q-2xqx-f4q5

## References

- [https://github.com/sequelize/sequelize/blob/master/changelog.md](https://github.com/sequelize/sequelize/blob/master/changelog.md)
- [https://www.npmjs.com/advisories/109](https://www.npmjs.com/advisories/109)

## Related threats

- [Sequelize SQL injection in Oracle dialect escape function](https://junglewise.ai/threats/cve-2026-69240-sequelize-sql-injection-in-oracle-dialect-escape-function)
- [Sequelize SQL injection in JSON where clause processing](https://junglewise.ai/threats/cve-2026-30951-sequelize-sql-injection-in-json-where-clause-processing)
- [Sequelize SQL injection via unescaped parentheses in attributes](https://junglewise.ai/threats/cve-2023-22578-sequelize-sql-injection-via-unescaped-parentheses-in-attributes)
- [Sequelize unsafe fall-through in getWhereConditions](https://junglewise.ai/threats/cve-2023-22579-sequelize-unsafe-fall-through-in-getwhereconditions)
- [Sequelize SQL injection via replacements](https://junglewise.ai/threats/cve-2023-25813-sequelize-sql-injection-via-replacements)