CVE-2023-22580: Sequelize information disclosure vulnerability
Summary
CVE-2023-22580: Sequelize information disclosure vulnerability. Affects sequelize versions < 6.28.1. Fixed in 6.28.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sequelize is a JavaScript Object-Relational Mapping (ORM) library for Node.js that provides easy access to databases. It simplifies database operations by mapping database tables to JavaScript objects and vice versa. Sequelize is widely used in web applications to interact with databases and perform CRUD operations. However, a vulnerability has been discovered in the library that can lead to information disclosure.
Vulnerability Detail
The vulnerability in Sequelize is due to improper input filtering. Malicious queries can be crafted to exploit this vulnerability and potentially disclose sensitive information. This can have serious ramifications, as an attacker could gain unauthorized access to sensitive data stored in the database. The vulnerability has been assigned a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 6.37.8 as of 23 Oct 2026
npm install sequelize@6.37.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.28.1
This is the first release that contains the fix.
npm install sequelize@6.28.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to update to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the Sequelize library is vulnerable to an information disclosure vulnerability due to improper input filtering. To mitigate this vulnerability, it is crucial to update the affected packages to the fixed versions. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for sequelize →
FAQ
Sequelize is a JavaScript ORM library for Node.js that simplifies database operations by mapping database tables to JavaScript objects and vice versa.
The vulnerability can lead to information disclosure, allowing attackers to potentially access sensitive data stored in the database.
To fix this vulnerability, update the affected packages ('sequelize' and '@sequelize/core') to the fixed versions mentioned in the 'how_to_fix' section.
No specific workaround is mentioned for this vulnerability. It is recommended to update to the fixed versions.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for sequelize.
