Read the docs
TI-2023-08775 Aliases CVE-2023-22580GHSA-8c25-f3mj-v6h8

Sequalize - Bad query filtering leading to SQL errors

Priority MEDIUM 40CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00582 48th percentileScored 2026-11-07
Fix Fixed Sequelize.js (Feathers-Sequalize): v7.0.0-alpha.20sequelize (npm): 6.28.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Feathers-SequalizeSequelize.jsbefore v7.0.0-alpha.20v7.0.0-alpha.20Patch availableCNA
—sequelize (npm)before 6.28.16.28.1Patch availableGHSA-8c25-f3mj-v6h8
—@sequelize/core (npm)before 7.0.0-alpha.207.0.0-alpha.20Patch availableGHSA-8c25-f3mj-v6h8
  • Sequelize.js VendorFeathers-Sequalize Affected before v7.0.0-alpha.20 Fixed in v7.0.0-alpha.20 Patch available CNA
  • sequelize (npm) Vendor— Affected before 6.28.1 Fixed in 6.28.1 Patch available GHSA-8c25-f3mj-v6h8
  • @sequelize/core (npm) Vendor— Affected before 7.0.0-alpha.20 Fixed in 7.0.0-alpha.20 Patch available GHSA-8c25-f3mj-v6h8

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:sequelizejs:sequelize:*:*:*:*:*:node.js:*:*before 6.28.1VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha1:*:*:*:node.js:*:*7.0.0 alpha1VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha10:*:*:*:node.js:*:*7.0.0 alpha10VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha11:*:*:*:node.js:*:*7.0.0 alpha11VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha12:*:*:*:node.js:*:*7.0.0 alpha12VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha13:*:*:*:node.js:*:*7.0.0 alpha13VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha14:*:*:*:node.js:*:*7.0.0 alpha14VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha15:*:*:*:node.js:*:*7.0.0 alpha15VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha16:*:*:*:node.js:*:*7.0.0 alpha16VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha17:*:*:*:node.js:*:*7.0.0 alpha17VulnerableFeathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:*:*:*:*:*:node.js:*:* Versions before 6.28.1 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha1:*:*:*:node.js:*:* Versions 7.0.0 alpha1 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha10:*:*:*:node.js:*:* Versions 7.0.0 alpha10 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha11:*:*:*:node.js:*:* Versions 7.0.0 alpha11 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha12:*:*:*:node.js:*:* Versions 7.0.0 alpha12 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha13:*:*:*:node.js:*:* Versions 7.0.0 alpha13 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha14:*:*:*:node.js:*:* Versions 7.0.0 alpha14 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha15:*:*:*:node.js:*:* Versions 7.0.0 alpha15 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha16:*:*:*:node.js:*:* Versions 7.0.0 alpha16 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha17:*:*:*:node.js:*:* Versions 7.0.0 alpha17 Vulnerable ·Feathers-Sequalize
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha18:*:*:*:node.js:*:*7.0.0 alpha18VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha19:*:*:*:node.js:*:*7.0.0 alpha19VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2:*:*:*:node.js:*:*7.0.0 alpha2VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.1:*:*:*:node.js:*:*7.0.0 alpha2.1VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.2:*:*:*:node.js:*:*7.0.0 alpha2.2VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha3:*:*:*:node.js:*:*7.0.0 alpha3VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha4:*:*:*:node.js:*:*7.0.0 alpha4VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha5:*:*:*:node.js:*:*7.0.0 alpha5VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha6:*:*:*:node.js:*:*7.0.0 alpha6VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha7:*:*:*:node.js:*:*7.0.0 alpha7VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha8:*:*:*:node.js:*:*7.0.0 alpha8VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha9:*:*:*:node.js:*:*7.0.0 alpha9VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_1:*:*:*:node.js:*:*7.0.0 oc_test_1VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_2:*:*:*:node.js:*:*7.0.0 oc_test_2VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_3:*:*:*:node.js:*:*7.0.0 oc_test_3VulnerableFeathers-Sequalize
cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_4:*:*:*:node.js:*:*7.0.0 oc_test_4VulnerableFeathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha18:*:*:*:node.js:*:* Versions 7.0.0 alpha18 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha19:*:*:*:node.js:*:* Versions 7.0.0 alpha19 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2:*:*:*:node.js:*:* Versions 7.0.0 alpha2 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.1:*:*:*:node.js:*:* Versions 7.0.0 alpha2.1 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha2.2:*:*:*:node.js:*:* Versions 7.0.0 alpha2.2 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha3:*:*:*:node.js:*:* Versions 7.0.0 alpha3 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha4:*:*:*:node.js:*:* Versions 7.0.0 alpha4 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha5:*:*:*:node.js:*:* Versions 7.0.0 alpha5 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha6:*:*:*:node.js:*:* Versions 7.0.0 alpha6 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha7:*:*:*:node.js:*:* Versions 7.0.0 alpha7 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha8:*:*:*:node.js:*:* Versions 7.0.0 alpha8 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:alpha9:*:*:*:node.js:*:* Versions 7.0.0 alpha9 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_1:*:*:*:node.js:*:* Versions 7.0.0 oc_test_1 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_2:*:*:*:node.js:*:* Versions 7.0.0 oc_test_2 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_3:*:*:*:node.js:*:* Versions 7.0.0 oc_test_3 Vulnerable ·Feathers-Sequalize
  • cpe:2.3:a:sequelizejs:sequelize:7.0.0:oc_test_4:*:*:*:node.js:*:* Versions 7.0.0 oc_test_4 Vulnerable ·Feathers-Sequalize

Remediation

  • Fix · CNA Sequelize.js (Feathers-Sequalize) Fixed in v7.0.0-alpha.20
  • Fix · GHSA-8c25-f3mj-v6h8 sequelize (npm) Fixed in 6.28.1 Advisory →
  • Fix · GHSA-8c25-f3mj-v6h8 @sequelize/core (npm) Fixed in 7.0.0-alpha.20 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22580
  2. 2026-10-03 Alias added: GHSA-8c25-f3mj-v6h8

References

Advisory 3

Other 6

  • TI-2023-11083 SQL Injection via replacements in sequelize CVSS 3.1CRITICAL 10.0
  • TI-2023-08773 Sequalize - Default support for “raw attributes” when using parentheses CVSS 3.1CRITICAL 10.0
  • TI-2016-08595 SQL injection in HackerOne sequelize node module CVSS 3.0CRITICAL 9.8
  • TI-2016-08591 SQL injection in HackerOne sequelize node module CVSS 3.0CRITICAL 9.8
  • TI-2019-08017 SQL injection in sequelize CVSS 3.1CRITICAL 9.8
  • TI-2019-08014 SQL injection in sequelize CVSS 3.1CRITICAL 9.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences