Executive brief
sequelize-typescript is a TypeScript ORM library for Node.js that simplifies database interactions. A prototype pollution vulnerability in versions before 2.1.6 allows attackers to modify core JavaScript object properties without authentication, potentially causing application crashes or unexpected behavior across the system.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in sequelize-typescript that permits unauthorized modification of the Object prototype. An attacker with network access can exploit this via crafted input to corrupt the base object prototype, affecting all objects in the affected application. The vulnerability is network-reachable with no authentication or user interaction required. The fix (commit 5ce8afd and version 2.1.6) explicitly denies modification of the object prototype, preventing the attack.
Affected products
- Robin Buschmann sequelize-typescript before 2.1.6
Timeline
- 2023-11-24: disclosed: Published on OSV and NVD
- 2023-11-24: patched: Version 2.1.6 released with prototype pollution protections