SB2023022262 - SQL injection in Sequelize
Published: February 22, 2023 Updated: April 27, 2026
Security Bulletin ID
SB2023022262
CSH Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) SQL injection (CVE-ID: CVE-2023-25813)
The vulnerability allows a remote attacker to execute arbitrary SQL commands.
The vulnerability exists due to improper neutralization of special elements used in an SQL command in the replacements processing in sequelize.query when handling queries that combine the where option with replacements. A remote attacker can supply crafted replacement values to execute arbitrary SQL commands.
Remediation
Install update from vendor's website.