CVE-2023-22579: Unsafe fall-through in getWhereConditions in Sequelize
Summary
CVE-2023-22579: Unsafe fall-through in getWhereConditions. Affects sequelize versions < 6.28.1. Fixed in 6.28.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sequelize is an open-source Object-Relational Mapping (ORM) library for Node.js that provides easy access to databases. It allows developers to interact with databases using JavaScript objects instead of writing raw SQL queries. Sequelize is widely used in web applications to handle database operations efficiently and securely. However, a vulnerability has been discovered in the library that could lead to potential security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2023-22579, exists in the getWhereConditions function of Sequelize. When an invalid value is provided to the where option of a query, Sequelize ignores the option instead of throwing an error. This behavior can result in unintended consequences and may allow attackers to bypass security measures or perform unauthorized actions. For example, a finder call like User.findAll({ where: new Date() }) would not throw an error, potentially leading to unexpected data retrieval or modification.
How To Fix
Latest published version: 6.37.8 as of 23 Oct 2026
npm install sequelize@6.37.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.28.1
This is the first release that contains the fix.
npm install sequelize@6.28.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually validate the where option before passing it to Sequelize. This can be done by checking the type of the value and ensuring it is a valid JavaScript object. Here's an example of how to implement this workaround:
const whereOption = new Date();
if (typeof whereOption === 'object' && !Array.isArray(whereOption)) {
User.findAll({ where: whereOption });
} else {
// Handle invalid where option
}
Conclusion
In conclusion, the vulnerability in Sequelize's getWhereConditions function could allow attackers to bypass security measures and perform unauthorized actions on the database. It is crucial to update the Sequelize library to version 6.28.1 or later and review any code that uses the where option. By following these steps, developers can mitigate the risk associated with this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sequelize →
FAQ
Sequelize is an open-source Object-Relational Mapping (ORM) library for Node.js that simplifies database operations by allowing developers to interact with databases using JavaScript objects.
The vulnerability allows attackers to provide invalid values to the where option of a query, bypassing security measures and potentially performing unauthorized actions on the database.
To fix this vulnerability, update the Sequelize library to version 6.28.1 or later by running npm install sequelize@6.28.1 in your Node.js project. Additionally, review and update any code that uses the where option to ensure only valid values are provided.
Yes, a temporary workaround is to manually validate the where option before passing it to Sequelize. Check the type of the value and ensure it is a valid JavaScript object.
You can find more information about this vulnerability in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-vqfx-gj96-3w95/GHSA-vqfx-gj96-3w95.json
References
Related vulnerabilities
Recent vulnerabilities recorded for sequelize.
