GHSA-8mwq-mj73-qv68
Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements
- Severity
- 10.0 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-790 Improper Filtering of Special Elements
- Fix
- Available
- 2 packages have a fixed version
Description
Duplicate advisory
This advisory has been withdrawn because it is a duplicate of GHSA-f598-mfpv-gmfx. This link is maintained to preserve external references.
Original Description
Due to improper attribute filtering in the sequelize js library, an attacker can peform SQL injections. This issue can be mitigated by not accepting untrusted input.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| @sequelize/core | < 7.0.0-alpha.20 |
7.0.0-alpha.20 |
| sequelize | < 6.29.0 |
6.29.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
@sequelize/core npm → 7.0.0-alpha.20
- npm
npm install @sequelize/core@7.0.0-alpha.20- yarn
yarn add @sequelize/core@7.0.0-alpha.20- pnpm
pnpm add @sequelize/core@7.0.0-alpha.20
sequelize npm → 6.29.0
- npm
npm install sequelize@6.29.0- yarn
yarn add sequelize@6.29.0- pnpm
pnpm add sequelize@6.29.0
Severity breakdown
CVSS 3.1 10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-790: Improper Filtering of Special Elements
The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Withdrawn
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-v8fg-2rw7-q452 Sequelize: SQL Injection (Oracle DB) | Critical | Also affects sequelize |
| GHSA-6457-6jrx-69cr Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type | High | Also affects sequelize |
| GHSA-wrh9-cjv3-2hpw Sequelize vulnerable to SQL Injection via replacements | Critical | Also affects sequelize |
| GHSA-8c25-f3mj-v6h8 Sequelize information disclosure vulnerability | High | Also affects sequelize |
| GHSA-vqfx-gj96-3w95 Unsafe fall-through in getWhereConditions | High | Also affects sequelize |
| GHSA-f598-mfpv-gmfx Sequelize - Default support for “raw attributes” when using parentheses | Critical | Also affects sequelize |
| GHSA-fw4p-36j9-rrj3 Denial of Service in sequelize | Medium | Also affects sequelize |
| GHSA-5v9h-q3gj-c32x SQL Injection via GeoJSON in sequelize | Critical | Also affects sequelize |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor