GHSA-8c25-f3mj-v6h8
Sequelize information disclosure vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | sequelize | < 6.28.1 | 6.28.1 |
| npm | @sequelize/core | < 7.0.0-alpha.20 | 7.0.0-alpha.20 |
Details
As written in the advisory (Markdown source, shown as plain text).
Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-22580
- https://github.com/sequelize/sequelize/pull/15375
- https://github.com/sequelize/sequelize/pull/15699
- https://csirt.divd.nl/CVE-2023-22580
- https://csirt.divd.nl/DIVD-2022-00020
- https://github.com/sequelize/sequelize
- https://github.com/sequelize/sequelize/releases/tag/v6.28.1
- https://github.com/sequelize/sequelize/releases/tag/v7.0.0-alpha.20