# CVE-2016-10554: Sequelize SQL injection in SQLite escape handling

Source: https://junglewise.ai/threats/cve-2016-10554-sequelize-sql-injection-in-sqlite-escape-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-02-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2016-10554 · Severity: info · CVSS 0 · Published 2019-02-18

Sequelize is a popular database abstraction library for Node.js applications. When connecting to SQLite databases, the library incorrectly used MySQL's string escape syntax instead of SQLite's syntax, allowing attackers to inject malicious SQL code and potentially read, modify, or delete data in the database.

Technologies: [sequelize (npm)](https://junglewise.ai/threats/technologies/sequelize). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2016-10554 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-10554 being exploited in the wild.

**How severe is CVE-2016-10554?** Informational severity, with a CVSS score of 0, published 18 February 2019.

**Which products and versions are affected?** sequelize (npm) SEMVER:introduced=0,fixed=1.7.0.

**Is there a fix for CVE-2016-10554?** Yes. sequelize (npm): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-10554 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-10554?** Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sequelize (npm): upgrade to 1.7.0 or later

  ```sh
  npm install sequelize@1.7.0
  ```


## Technical details

The vulnerability is a SQL injection flaw (CWE-89) in Sequelize's string escaping logic. The root cause is that the library defaulted to MySQL's backslash-based escape syntax when handling SQLite connections, but SQLite actually uses PostgreSQL-style escaping. This mismatch allows specially crafted input strings to break out of intended query constraints. The vulnerability affects all versions prior to 1.7.0-alpha3. An attacker can exploit this by providing malicious input to any Sequelize query that accepts user-supplied data without proper validation, potentially extracting or modifying database contents.

## Affected products

- Sequelize Sequelize prior to 1.7.0-alpha3

## Identifiers

- CVE-2016-10554
- GHSA-x2jc-pwfj-h9p3

## Timeline

- 2019-02-18: disclosed
- 2016: patched: Fix committed to repository; version 1.7.0-alpha3 or later contains the patch

## References

- [https://github.com/sequelize/sequelize/commit/c876192aa6ce1f67e22b26a4d175b8478615f42d](https://github.com/sequelize/sequelize/commit/c876192aa6ce1f67e22b26a4d175b8478615f42d)

## Related threats

- [Sequelize SQL injection in Oracle dialect escape function](https://junglewise.ai/threats/cve-2026-69240-sequelize-sql-injection-in-oracle-dialect-escape-function)
- [Sequelize SQL injection in JSON where clause processing](https://junglewise.ai/threats/cve-2026-30951-sequelize-sql-injection-in-json-where-clause-processing)
- [Sequelize SQL injection via unescaped parentheses in attributes](https://junglewise.ai/threats/cve-2023-22578-sequelize-sql-injection-via-unescaped-parentheses-in-attributes)
- [Sequelize unsafe fall-through in getWhereConditions](https://junglewise.ai/threats/cve-2023-22579-sequelize-unsafe-fall-through-in-getwhereconditions)
- [Sequelize SQL injection via replacements](https://junglewise.ai/threats/cve-2023-25813-sequelize-sql-injection-via-replacements)