Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter.

Proof of Concept

Test.findAndCountAll({
where: { id :1 },
order : [['id', 'UNTRUSTED USER INPUT']]
})

Recommendation

Update to version 2.0.0-rc8 or later

References

• https://nvd.nist.gov/vuln/detail/CVE-2015-1369
• sequelize/sequelize#2906
• GHSA-xqg8-cv3h-xppv
• https://www.npmjs.com/advisories/33
• sequelize/sequelize#2919
• http://www.openwall.com/lists/oss-security/2015/01/23/2