Skip to content
OpenAdvisories
Critical · 10.0 CVE-2023-22578 EUVD-2023-0694GHSA-f598-mfpv-gmfx

Sequalize - Default support for “raw attributes” when using parentheses

Published Feb 16, 2023 · Updated Apr 1, 2025 · Assigned by DIVD

Vendor: Feathers-Sequalize Product: Sequelize.js Package: @sequelize/core Package: sequelize Ecosystem: npm

Description

Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.

Affected products

VendorProductAffectedFixed
Feathers-Sequalize Sequelize.js <v7.0.0-alpha.20 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @sequelize/core < 7.0.0-alpha.20 7.0.0-alpha.20 GHSA-f598-mfpv-gmfx
npm sequelize < 6.29.0 6.29.0 GHSA-f598-mfpv-gmfx

References