Sequalize - Default support for “raw attributes” when using parentheses
Priority MEDIUM 50CWE-790Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00831 57th percentileScored 2026-11-07
Fix Fixed Sequelize.js (Feathers-Sequalize): v7.0.0-alpha.20@sequelize/core (npm): 7.0.0-alpha.20+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Feathers-Sequalize | Sequelize.js | before v7.0.0-alpha.20 | v7.0.0-alpha.20 | Patch available | CNA |
| — | @sequelize/core (npm) | before 7.0.0-alpha.20 | 7.0.0-alpha.20 | Patch available | GHSA-f598-mfpv-gmfx |
| — | sequelize (npm) | before 6.29.0 | 6.29.0 | Patch available | GHSA-f598-mfpv-gmfx |
- Sequelize.js VendorFeathers-Sequalize Affected before v7.0.0-alpha.20 Fixed in v7.0.0-alpha.20 Patch available CNA
- @sequelize/core (npm) Vendor— Affected before 7.0.0-alpha.20 Fixed in 7.0.0-alpha.20 Patch available GHSA-f598-mfpv-gmfx
- sequelize (npm) Vendor— Affected before 6.29.0 Fixed in 6.29.0 Patch available GHSA-f598-mfpv-gmfx
CPE configurations NVD · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sequelizejs:sequelize:*:*:*:*:*:node.js:*:* | before 6.29.0 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha1:*:*:*:node.js:*:* | 7.0.0 alpha1 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha10:*:*:*:node.js:*:* | 7.0.0 alpha10 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha11:*:*:*:node.js:*:* | 7.0.0 alpha11 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha12:*:*:*:node.js:*:* | 7.0.0 alpha12 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha13:*:*:*:node.js:*:* | 7.0.0 alpha13 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha14:*:*:*:node.js:*:* | 7.0.0 alpha14 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha15:*:*:*:node.js:*:* | 7.0.0 alpha15 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha16:*:*:*:node.js:*:* | 7.0.0 alpha16 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha17:*:*:*:node.js:*:* | 7.0.0 alpha17 | Vulnerable | Feathers-Sequalize |
- cpe:2.3:a:sequelizejs:sequelize:*:*:*:*:*:node.js:*:* Versions before 6.29.0 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha1:*:*:*:node.js:*:* Versions 7.0.0 alpha1 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha10:*:*:*:node.js:*:* Versions 7.0.0 alpha10 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha11:*:*:*:node.js:*:* Versions 7.0.0 alpha11 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha12:*:*:*:node.js:*:* Versions 7.0.0 alpha12 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha13:*:*:*:node.js:*:* Versions 7.0.0 alpha13 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha14:*:*:*:node.js:*:* Versions 7.0.0 alpha14 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha15:*:*:*:node.js:*:* Versions 7.0.0 alpha15 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha16:*:*:*:node.js:*:* Versions 7.0.0 alpha16 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha17:*:*:*:node.js:*:* Versions 7.0.0 alpha17 Vulnerable ·Feathers-Sequalize
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha18:*:*:*:node.js:*:* | 7.0.0 alpha18 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha19:*:*:*:node.js:*:* | 7.0.0 alpha19 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2:*:*:*:node.js:*:* | 7.0.0 alpha2 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.1:*:*:*:node.js:*:* | 7.0.0 alpha2.1 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.2:*:*:*:node.js:*:* | 7.0.0 alpha2.2 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha3:*:*:*:node.js:*:* | 7.0.0 alpha3 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha4:*:*:*:node.js:*:* | 7.0.0 alpha4 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha5:*:*:*:node.js:*:* | 7.0.0 alpha5 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha6:*:*:*:node.js:*:* | 7.0.0 alpha6 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha7:*:*:*:node.js:*:* | 7.0.0 alpha7 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha8:*:*:*:node.js:*:* | 7.0.0 alpha8 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha9:*:*:*:node.js:*:* | 7.0.0 alpha9 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_1:*:*:*:node.js:*:* | 7.0.0 oc_test_1 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_2:*:*:*:node.js:*:* | 7.0.0 oc_test_2 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_3:*:*:*:node.js:*:* | 7.0.0 oc_test_3 | Vulnerable | Feathers-Sequalize |
| cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_4:*:*:*:node.js:*:* | 7.0.0 oc_test_4 | Vulnerable | Feathers-Sequalize |
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha18:*:*:*:node.js:*:* Versions 7.0.0 alpha18 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha19:*:*:*:node.js:*:* Versions 7.0.0 alpha19 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2:*:*:*:node.js:*:* Versions 7.0.0 alpha2 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.1:*:*:*:node.js:*:* Versions 7.0.0 alpha2.1 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.2:*:*:*:node.js:*:* Versions 7.0.0 alpha2.2 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha3:*:*:*:node.js:*:* Versions 7.0.0 alpha3 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha4:*:*:*:node.js:*:* Versions 7.0.0 alpha4 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha5:*:*:*:node.js:*:* Versions 7.0.0 alpha5 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha6:*:*:*:node.js:*:* Versions 7.0.0 alpha6 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha7:*:*:*:node.js:*:* Versions 7.0.0 alpha7 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha8:*:*:*:node.js:*:* Versions 7.0.0 alpha8 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha9:*:*:*:node.js:*:* Versions 7.0.0 alpha9 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_1:*:*:*:node.js:*:* Versions 7.0.0 oc_test_1 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_2:*:*:*:node.js:*:* Versions 7.0.0 oc_test_2 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_3:*:*:*:node.js:*:* Versions 7.0.0 oc_test_3 Vulnerable ·Feathers-Sequalize
- cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_4:*:*:*:node.js:*:* Versions 7.0.0 oc_test_4 Vulnerable ·Feathers-Sequalize
Remediation
- Fix · CNA Sequelize.js (Feathers-Sequalize) Fixed in v7.0.0-alpha.20
- Fix · GHSA-f598-mfpv-gmfx @sequelize/core (npm) Fixed in 7.0.0-alpha.20 Advisory →
- Fix · GHSA-f598-mfpv-gmfx sequelize (npm) Fixed in 6.29.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-22578
- 2026-10-03 Alias added: GHSA-f598-mfpv-gmfx
References
Advisory 3
Other 7
- https://github.com/sequelize/sequelize/security/advisories/GHSA-f598-mfpv-gmfx
- https://github.com/sequelize/sequelize/pull/15710
- https://csirt.divd.nl/DIVD-2022-00020
- https://github.com/sequelize/sequelize
- https://github.com/sequelize/sequelize/discussions/15694
- https://github.com/sequelize/sequelize/releases/tag/v6.29.0
- https://github.com/sequelize/sequelize/releases/tag/v7.0.0-alpha.20
More Feathers-Sequalize Sequelize vulnerabilities
- TI-2023-11083 SQL Injection via replacements in sequelize CVSS 3.1CRITICAL 10.0
- TI-2016-08595 SQL injection in HackerOne sequelize node module CVSS 3.0CRITICAL 9.8
- TI-2016-08591 SQL injection in HackerOne sequelize node module CVSS 3.0CRITICAL 9.8
- TI-2019-08017 SQL injection in sequelize CVSS 3.1CRITICAL 9.8
- TI-2019-08014 SQL injection in sequelize CVSS 3.1CRITICAL 9.8
- TI-2019-08013 SQL injection in Sequelize CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-22578 · CVE Program
- CVE-2023-22578 · NVD
- FIRST EPSS
- GHSA-f598-mfpv-gmfx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences