CVE-2023-25813: SQL Injection via replacements in sequelize

Q: What is the vulnerability ID of this security issue in Sequelize?

The vulnerability ID of this security issue in Sequelize is CVE-2023-25813.

Q: What is Sequelize?

Sequelize is a Node.js ORM (Object-Relational Mapping) tool.

Q: What is the severity of CVE-2023-25813?

The severity of CVE-2023-25813 is critical with a severity value of 9.8.

Q: What is the affected software version of Sequelize?

Sequelize versions prior to 6.19.1 are affected by this vulnerability.

Q: How can the SQL injection exploit in Sequelize be fixed?

The SQL injection exploit in Sequelize can be fixed by upgrading to version 6.19.1 or later.

Published Feb 22, 2023

Updated

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fixed in Sequelize 6.19.1. Users are advised to upgrade. Users unable to upgrade should not use the replacements and the where option in the same query.

Affected Software

1 affected component

Sequelizejs Sequelize Node.js<6.19.1

Remediation

Patch Available

https://github.com/sequelize/sequelize/commit/ccaa3996047fe00048d5993ab2dd43ebadd4f78b

Event History

Feb 22, 2023

CVE Published

via MITRE·06:14 PM

Data Sourced

via MITRE·06:14 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this security issue in Sequelize?

The vulnerability ID of this security issue in Sequelize is CVE-2023-25813.

What is Sequelize?

Sequelize is a Node.js ORM (Object-Relational Mapping) tool.

What is the severity of CVE-2023-25813?