CVE-2023-25813: Sequelize SQL Injection via Replacements
Summary
CVE-2023-25813: Sequelize vulnerable to SQL Injection via replacements. Affects sequelize versions < 6.19.1. Fixed in 6.19.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sequelize is an open-source Node.js ORM (Object-Relational Mapping) library for accessing relational databases. It provides an easy-to-use API for performing database operations and supports various database systems. However, Sequelize versions prior to 6.19.1 are vulnerable to SQL Injection attacks when using replacements in conjunction with the where option. This vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or even data loss.
Vulnerability Detail
The SQL Injection vulnerability in Sequelize arises due to the way it processes queries with replacements and the where option. When constructing a query, Sequelize first builds the query using the where option and then passes it to sequelize.query, which injects the replacements. However, this process can be exploited by an attacker to inject malicious SQL code. By providing specially crafted values for the replacements, an attacker can manipulate the resulting SQL query and execute arbitrary SQL statements. For example, an attacker could pass a value like "OR true; DROP TABLE users;" as a replacement, resulting in the execution of unintended SQL commands.
How To Fix
Latest published version: 6.37.8 as of 23 Oct 2026
npm install sequelize@6.37.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.19.1
This is the first release that contains the fix.
npm install sequelize@6.19.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately upgrade to Sequelize 6.19.1, a workaround is to avoid using the replacements and where options together in the same query. By separating the replacements and the where conditions, you can reduce the risk of SQL Injection. Instead of using replacements, consider using parameterized queries or sanitizing user input before constructing the query.
Conclusion
The Sequelize SQL Injection vulnerability allows attackers to execute arbitrary SQL queries, posing a significant risk to the integrity and security of the affected database. It is crucial to upgrade to Sequelize 6.19.1 or later to fix this vulnerability. If immediate upgrade is not possible, follow the provided workaround and ensure proper input sanitization. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for sequelize →
FAQ
Sequelize is an open-source Node.js ORM library that provides an easy-to-use API for interacting with relational databases.
SQL Injection is a type of security vulnerability where an attacker can manipulate SQL queries to execute unintended commands or gain unauthorized access to a database.
The vulnerability occurs when Sequelize processes queries with replacements and the where option. Improper handling of replacements allows an attacker to inject malicious SQL code.
Exploiting this vulnerability can lead to unauthorized access, data manipulation, or even data loss. An attacker could execute arbitrary SQL statements, potentially compromising the integrity and confidentiality of the database.
To mitigate the risk, it is recommended to upgrade to Sequelize version 6.19.1 or later. Additionally, separate the replacements and where conditions in your queries, and consider using parameterized queries or sanitizing user input.
References
Related vulnerabilities
Recent vulnerabilities recorded for sequelize.
