MEDIUM5.3
GHSA-8c25-f3mj-v6h8
Sequelize information disclosure vulnerability
Quick fix
GHSA-8c25-f3mj-v6h8 — sequelize: upgrade to the fixed version with the command below.
npm install sequelize@6.28.1Details
Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/@sequelize/core
Introduced in:
0Fixed in: 7.0.0-alpha.20Fix
npm install @sequelize/core@7.0.0-alpha.20References
- https://nvd.nist.gov/vuln/detail/CVE-2023-22580[ADVISORY]
- https://github.com/sequelize/sequelize/pull/15375[WEB]
- https://github.com/sequelize/sequelize/pull/15699[WEB]
- https://csirt.divd.nl/CVE-2023-22580[WEB]
- https://csirt.divd.nl/DIVD-2022-00020[WEB]
- https://github.com/sequelize/sequelize[PACKAGE]
- https://github.com/sequelize/sequelize/releases/tag/v6.28.1[WEB]
- https://github.com/sequelize/sequelize/releases/tag/v7.0.0-alpha.20[WEB]