# CVE-2023-22580: Sequelize information disclosure via improper input filtering

Source: https://junglewise.ai/threats/cve-2023-22580-sequelize-information-disclosure-via-improper-input-filtering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-02-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-22580 · Severity: low · CVSS 3.1 · Published 2023-02-16

Sequelize is a popular Node.js ORM library used to interact with databases in web applications. A vulnerability in input filtering allows attackers to craft malicious queries that expose sensitive database information without requiring authentication or user interaction. This could lead to unauthorized data leakage affecting customer privacy and application security.

Technologies: [@sequelize/core (npm)](https://junglewise.ai/threats/technologies/sequelize-core), [sequelize (npm)](https://junglewise.ai/threats/technologies/sequelize). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-22580 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-22580 being exploited in the wild.

**How severe is CVE-2023-22580?** Low severity, with a CVSS score of 3.1, published 16 February 2023.

**Which products and versions are affected?** @sequelize/core (npm) SEMVER:introduced=0,fixed=7.0.0-alpha.20; sequelize (npm) SEMVER:introduced=0,fixed=6.28.1.

**Is there a fix for CVE-2023-22580?** Yes. @sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later; sequelize (npm): upgrade to 6.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-22580 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-22580?** Check whether you run @sequelize/core (npm) or sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later

  ```sh
  npm install @sequelize/core@7.0.0-alpha.20
  ```

- sequelize (npm): upgrade to 6.28.1 or later

  ```sh
  npm install sequelize@6.28.1
  ```


## Technical details

The vulnerability stems from improper input filtering in Sequelize's query handling mechanism, specifically in the `where` clause processing (CWE-200: Information Exposure). Attackers can supply specially crafted query parameters to bypass intended filters and access sensitive database records. The attack requires network access to the application but no authentication; it can be triggered through standard application queries. The vulnerability was fixed in Sequelize v6.28.1 and v7.0.0-alpha.20, with patches implemented in pull requests #15375 and #15699 that enforce stricter validation on `where` clause values.

## Affected products

- Sequelize sequelize All versions before 6.28.1
- Sequelize @sequelize/core All versions before 7.0.0-alpha.20

## Identifiers

- CVE-2023-22580
- GHSA-8c25-f3mj-v6h8

## Timeline

- 2023-02-16: disclosed
- 2023-02-16: patched: Fixes released in v6.28.1 and v7.0.0-alpha.20

## References

- [https://github.com/sequelize/sequelize/pull/15375](https://github.com/sequelize/sequelize/pull/15375)

## Related threats

- [Sequelize SQL injection in Oracle dialect escape function](https://junglewise.ai/threats/cve-2026-69240-sequelize-sql-injection-in-oracle-dialect-escape-function)
- [Sequelize SQL injection in JSON where clause processing](https://junglewise.ai/threats/cve-2026-30951-sequelize-sql-injection-in-json-where-clause-processing)
- [Sequelize SQL injection via unescaped parentheses in attributes](https://junglewise.ai/threats/cve-2023-22578-sequelize-sql-injection-via-unescaped-parentheses-in-attributes)
- [Sequelize unsafe fall-through in getWhereConditions](https://junglewise.ai/threats/cve-2023-22579-sequelize-unsafe-fall-through-in-getwhereconditions)
- [Sequelize SQL injection via replacements](https://junglewise.ai/threats/cve-2023-25813-sequelize-sql-injection-via-replacements)