Sequelize information disclosure vulnerability

HIGH 7.5CVE-2023-22580 · GHSA-8c25-f3mj-v6h8 · Published 16/02/2023 · updated 17/06/2026

In short

CVE-2023-22580 is a HIGH (CVSS 7.5) vulnerability affecting sequelize (sequelizejs), @sequelize/core, sequelize.
Chance of exploitation in the next 30 days (EPSS): 0.58%, higher than 47.8% of all vulnerabilities.
Fix: update to 6.28.1, 7.0.0-alpha.20 or later.

Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure.

NVD description

Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

= 7.0.0< 6.28.1

6.28.1

npm

< 7.0.0-alpha.20

7.0.0-alpha.20

npm

< 6.28.1

6.28.1

More vulnerabilities in sequelize

See all →