LiveActive security incident?Get immediate response
CVE Record

CVE-2016-10556: sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB,...

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped. This causes potential SQL injection in sequelize 3.19.3 and earlier, where a malicious user could put `["test", "'); DELETE TestTable WHERE Id = 1 --')"]` inside of ``` database.query('SELECT * FROM TestTable WHERE Name IN (:names)', { replacements: { names: directCopyOfUserInput } }); ``` and cause the SQL statement to become `SELECT Id FROM Table WHERE Name IN ('test', '\'); DELETE TestTable WHERE Id = 1 --')`. In Postgres, MSSQL, and SQLite, the backslash has no special meaning. This causes the the statement to delete whichever Id has a value of 1 in the TestTable table.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This vulnerability affects older Sequelize for Node.js. In some databases, user-supplied array values in raw replacement queries can be escaped incorrectly, creating SQL injection risk. A successful attack could change or delete database records. The source bundle does not provide CVSS scoring or evidence of active exploitation.

Executive priority

Treat as priority remediation where affected apps handle trusted business data or customer data. The main business risk is database tampering or deletion through SQL injection, but exploitation status is not established in the provided sources.

Technical view

Sequelize 3.19.3 and earlier can mishandle arrays as strings for PostgreSQL, SQLite, and Microsoft SQL Server replacements. The issue maps to CWE-89 and affects raw query patterns using replacement arrays in IN clauses. The bundle does not confirm affected behavior for MySQL or MariaDB.

Likely exposure

Exposure is likely in Node.js applications using sequelize 3.19.3 or earlier with PostgreSQL, SQLite, or Microsoft SQL Server, especially where raw queries accept user-controlled replacement arrays.

Exploitation context

No KEV listing or cited source in the bundle supports active exploitation. The public description shows potential SQL injection and data deletion impact, but this response does not include exploit steps.

Researcher notes

The strongest evidence is the CVE description and linked Sequelize issue/advisory. Key unknowns are exact fixed version, exploit prevalence, and whether application code uses the vulnerable raw-query pattern.

Mitigation direction

  • Check Sequelize and advisory guidance for fixed or supported versions.
  • Inventory applications using sequelize 3.19.3 or earlier.
  • Prioritize PostgreSQL, SQLite, and Microsoft SQL Server deployments.
  • Review raw queries that pass user-controlled arrays into replacements.
  • Add input validation around array values pending confirmed remediation.

Validation and detection

  • Search package manifests and lockfiles for sequelize versions <=3.19.3.
  • Identify database engines used by affected applications.
  • Review raw database.query usage with replacement arrays.
  • Confirm whether user input can reach those replacement arrays.
  • Verify remediation against vendor guidance before closure.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-89: Database access and collection lookup

Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2016-10556 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
HackerOnesequelize node module<=3.19.3Listed
Weakness

CWE details

CWE-89

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-89 · source CWE mapping

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs