Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
18 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3. Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. PoC Suppose the application has the following code: An attacker can inject arbitrary sql expressions. http://host/path?firstName=TODATE('0','Y')||'' OR 1=1-- The resulted SQL will be: Impact Data theft and tampering.
Recommended action: Upgrade to 6.37.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. Affected: v6.x through 6.37.7. v7 (@sequelize/core) is not affected. Details In src/dialects/abstract/query-generator.js, traverseJSON() extracts a cast type from :: in JSON keys without validation: castKey() (line 1925) passes it to Utils.Cast, and handleSequelizeMethod() (line 1692) interpolates it directly: JSON path values are escaped via this.escape() in jsonPathExtractionQuery(), but the cast type is not. Suggested fix — whitelist known SQL data types: PoC npm install sequelize@6.37.7 sqlite3 Output: Impact SQL Injection (CWE-89) — Any application that passes user-controlled objects as where clause values for JSON/JSONB columns is vulnerable. An attacker can…
Recommended action: Upgrade to 6.37.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL Produced Patches This feature was deprecated in Sequelize 5, and using it prints a deprecation warning. This issue has been patched in @sequelize/core@7.0.0.alpha-20 and sequelize@6.29.0. In Sequelize 7, it now produces the following: In Sequelize 6, it throws an error explaining that we had to introduce a breaking change, and requires the user to explicitly opt-in to either the Sequelize 7 behavior (always escape) or the Sequelize 5 behavior (inline attributes that include () without escaping). See https://github.com/sequelize/sequelize/pull/15710 for more information. Mitigations Do not use user-provided content to build your list or attributes. If you do, make sure that attribute in question actually exists on your model by checking that it exists in the rawAttributes property of your model first. --- A discussion thread…
Recommended action: Upgrade to 6.29.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Providing an invalid value to the where option of a query caused Sequelize to ignore that option instead of throwing an error. A finder call like the following did not throw an error: As this option is typically used with plain javascript objects, be aware that this only happens at the top level of this option. Patches This issue has been patched in sequelize@6.28.1 & @sequelize/core@7.0.0.alpha-20 References A discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15698 CVE: CVE-2023-22579 Snyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-3324090
Recommended action: Upgrade to 6.28.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The SQL injection exploit is related to replacements. Here is such an example: In the following query, some parameters are passed through replacements, and some are passed directly through the where option. This is a very legitimate use case, but this query was vulnerable to SQL injection due to how Sequelize processed the query: Sequelize built a first query using the where option, then passed it over to sequelize.query which parsed the resulting SQL to inject all :replacements. If the user passed values such as Sequelize would first generate this query: Then would inject replacements in it, which resulted in this: As you can see this resulted in arbitrary user-provided SQL being executed. Patches The issue was fixed in Sequelize 6.19.1 Workarounds Do not use the replacements and the where option in the same query if you are not using Sequelize = 6.19.1 References See this thread for more information: https://github.com/sequelize/sequelize/issues/14519 Snyk:…
Recommended action: Upgrade to 6.19.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure.
Recommended action: Upgrade to 6.28.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of sequelize prior to 4.44.4 are vulnerable to Denial of Service (DoS). The SQLite dialect fails to catch a TypeError exception for the results variable. The results value may be undefined and trigger the error on a .map call. This may allow attackers to submit malicious input that forces the exception and crashes the Node process. The following proof-of-concept crashes the Node process: Recommendation Upgrade to version 4.44.4 or later.
Recommended action: Upgrade to 4.44.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of sequelize are vulnerable to SQL Injection in Models that have fields with the GEOMETRY DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using STGeomFromGeoJSON, and MySQL GeoJSON documents using GeomFromText. Recommendation Update to version 3.23.6 or later.
Recommended action: Upgrade to 3.23.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of sequelize prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation Upgrade to version 3.35.1 or later.
Recommended action: Upgrade to 3.35.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of sequelize are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the MariaDB and MySQL dialects, which may allow attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation If you are using sequelize 5.x, upgrade to version 5.8.11 or later. If you are using sequelize 4.x, upgrade to version 4.44.3 or later. If you are using sequelize 3.x, upgrade to version 3.35.1 or later.
Recommended action: Upgrade to 5.8.11, 4.44.3 or 3.35.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of sequelize are vulnerable to SQL Injection. The function sequelize.json() incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example: Recommendation If you are using sequelize 5.x, upgrade to version 5.15.1 or later. If you are using sequelize 4.x, upgrade to version 4.44.3 or later.
Recommended action: Upgrade to 5.15.1 or 4.44.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of sequelize prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as $gt are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection. Recommendation Upgrade to version 4.12.0 or later
Recommended action: Upgrade to 4.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of sequelize prior to 5.3.0 (excluding v3 and v4) are vulnerable to SQL Injection. PostgreSQL optionstandardconformingstrings is not set to on by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals. Recommendation Upgrade to version 5.3.0 or later.
Recommended action: Upgrade to 5.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of sequelize are vulnerable to SQL Injection in locations where user input is passed into the limit or order parameters of sequelize query calls, such as findOne or findAll. Recommendation Update to version 3.17.0 or later.
Recommended action: Upgrade to 3.17.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of sequelize are vulnerable to SQL Injection when user input is passed into findOne or into a statement such as where: "user input". Recommendation Update to version 3.0.0 or later. Version 3.0.0 will introduce a number of breaking changes. Thankfully, the project authors have provided a 2.x - 3.x upgrade guide to ease this transition. If upgrading is not an option, it is also possible to mitigate this by ensuring that all uses of where: "input" and findOne("input") are properly sanitized, such as by the use of a wrapper function.
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of sequelize use MySQL's backslash-based escape syntax when connecting to SQLite, despite the fact that SQLite uses PostgreSQL's escape syntax, which can result in a SQL Injection vulnerability. Recommendation Update to version 1.7.0-alpha3 or later.
Recommended action: Upgrade to 1.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of sequelize cast arrays to strings and fail to properly escape the resulting SQL statement, resulting in a SQL injection vulnerability. Proof of Concept In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped. Example Query: If the user inputs the value of :names as: The resulting SQL statement will be: As the backslash has no special meaning in PostgreSQL, MSSQL, or SQLite, the statement will delete the record in TestTable with an Id of 1. Recommendation Update to version 3.20.0 or later.
Recommended action: Upgrade to 3.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter. Proof of Concept Recommendation Update to version 2.0.0-rc8 or later
Recommended action: Upgrade to 2.0.0-rc8 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.