Executive brief
Sequelize is a popular database abstraction library for Node.js applications. When connecting to SQLite databases, the library incorrectly used MySQL's string escape syntax instead of SQLite's syntax, allowing attackers to inject malicious SQL code and potentially read, modify, or delete data in the database.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in Sequelize's string escaping logic. The root cause is that the library defaulted to MySQL's backslash-based escape syntax when handling SQLite connections, but SQLite actually uses PostgreSQL-style escaping. This mismatch allows specially crafted input strings to break out of intended query constraints. The vulnerability affects all versions prior to 1.7.0-alpha3. An attacker can exploit this by providing malicious input to any Sequelize query that accepts user-supplied data without proper validation, potentially extracting or modifying database contents.
Affected products
- Sequelize Sequelize prior to 1.7.0-alpha3
Timeline
- 2019-02-18: disclosed
- 2016: patched: Fix committed to repository; version 1.7.0-alpha3 or later contains the patch