CVE Feed

    Dashboard / CVE / CVE-2023-25813

    CVE-2023-25813

    Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fixed in Sequelize 6.19.1. Users are advised to upgrade. Users unable to upgrade should not use the `replacements` and the `where` option in the same query.

    Published:Feb 22, 2023
    Last Modified:Mar 10, 2025
    EPS:Feb 22, 2023
    EPSS Score:0.0609
    CVSS Score:10

    Affected Products

    Vendor
    Sequelizejs
    Product
    Sequelize

    Exploits

    https://github.com/sequelize/sequelize/issues/14519https://github.com/sequelize/sequelize/security/advisories/GHSA-wrh9-cjv3-2hpwhttps://github.com/sequelize/sequelize/issues/14519https://github.com/sequelize/sequelize/security/advisories/GHSA-wrh9-cjv3-2hpwhttps://github.com/bde574786/Sequelize-1day-CVE-2023-25813https://github.com/h-gunp/CVE-2023-25813-TESThttps://github.com/numbbvi/CVE-2023-25813https://github.com/pbj2647/CVE-2023-25813https://github.com/sea-middle/cve-2023-25813https://github.com/White-BAO/CVE-2023-25813

    Related CVEs

    CVE-2026-69240 (CVSS 9.8) — Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is se…
    CVE-2026-30951 (CVSS 7.5) — Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB…
    CVE-2023-22579 (CVSS 9.9) — Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.…
    CVE-2023-22578 (CVSS 10) — Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.…
    CVE-2023-22580 (CVSS 5.3) — Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive informati…
    CVE-2019-10749 (CVSS 9.8) — sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not bein…
    CVE-2019-10748 (CVSS 9.8) — Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path ke…
    CVE-2019-10752 (CVSS 9.8) — Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.js…
    CVE-2019-11069 (CVSS 7.5) — Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.…
    CVE-2016-10554 (CVSS 9.8) — sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQL…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High