Search for packages
| purl | pkg:npm/sequelize@6.19.1 |
| Next non-vulnerable version | 6.37.8 |
| Latest non-vulnerable version | 7.0.0-next.1 |
| Risk | 4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3ugq-njms-xkgd
Aliases: CVE-2023-22579 GHSA-vqfx-gj96-3w95 |
Unsafe fall-through in getWhereConditions Due to improper parameter filtering in the sequalize js library, can a attacker peform injection. |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-gzz4-8wz6-f3f9
Aliases: CVE-2023-22580 GHSA-8c25-f3mj-v6h8 |
Sequelize information disclosure vulnerability Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure. |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-xn4n-x26m-5qdx
Aliases: CVE-2026-30951 GHSA-6457-6jrx-69cr |
Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type SQL injection via unescaped cast type in JSON/JSONB `where` clause processing. The `_traverseJSON()` function splits JSON path keys on `::` to extract a cast type, which is interpolated raw into `CAST(... AS <type>)` SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. Affected: v6.x through 6.37.7. v7 (`@sequelize/core`) is not affected. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-zk15-66xk-2ydf | Sequelize vulnerable to SQL Injection via replacements Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fixed in Sequelize 6.19.1. Users are advised to upgrade. Users unable to upgrade should not use the `replacements` and the `where` option in the same query. |
CVE-2023-25813
GHSA-wrh9-cjv3-2hpw |