# Sequelize SQL injection via improper attribute filtering

Source: https://junglewise.ai/threats/sequelize-sql-injection-via-improper-attribute-filtering-12e6c501  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-02-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2023-02-16

Sequelize is a popular Object-Relational Mapping (ORM) library for Node.js that simplifies database interactions. An attacker can inject arbitrary SQL commands by supplying specially crafted input due to insufficient filtering of attributes, potentially allowing unauthorized data access, modification, or deletion. This vulnerability primarily affects applications that accept untrusted user input without proper validation.

Technologies: [@sequelize/core (npm)](https://junglewise.ai/threats/technologies/sequelize-core), [sequelize (npm)](https://junglewise.ai/threats/technologies/sequelize). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 16 February 2023.

**Which products and versions are affected?** @sequelize/core (npm) SEMVER:introduced=0,fixed=7.0.0-alpha.20; sequelize (npm) SEMVER:introduced=0,fixed=6.29.0.

**Is there a fix for This vulnerability?** Yes. @sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later; sequelize (npm): upgrade to 6.29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run @sequelize/core (npm) or sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later

  ```sh
  npm install @sequelize/core@7.0.0-alpha.20
  ```

- sequelize (npm): upgrade to 6.29.0 or later

  ```sh
  npm install sequelize@6.29.0
  ```


## Technical details

The vulnerability is classified as improper filtering of special elements (CWE-790) in the Sequelize ORM library. Inadequate attribute filtering allows attackers to construct SQL injection payloads that bypass input validation. The attack is network-accessible with no authentication or user interaction required. An attacker who can supply untrusted input to Sequelize database operations can execute arbitrary SQL commands with the privileges of the database connection, potentially leading to full compromise of data confidentiality, integrity, and availability. Patches are available in Sequelize 6.29.0 and @sequelize/core 7.0.0-alpha.20. Note: This advisory is marked as a duplicate of GHSA-f598-mfpv-gmfx.

## Affected products

- Sequelize sequelize < 6.29.0
- Sequelize @sequelize/core < 7.0.0-alpha.20

## Timeline

- 2023-02-16: disclosed: Advisory published
- 2023-02-24: other: Advisory withdrawn as duplicate

## References

- [https://csirt.divd.nl/CVE-2023-22578](https://csirt.divd.nl/CVE-2023-22578)

## Related threats

- [Sequelize SQL injection in Oracle dialect escape function](https://junglewise.ai/threats/cve-2026-69240-sequelize-sql-injection-in-oracle-dialect-escape-function)
- [Sequelize SQL injection in JSON where clause processing](https://junglewise.ai/threats/cve-2026-30951-sequelize-sql-injection-in-json-where-clause-processing)
- [Sequelize SQL injection via unescaped parentheses in attributes](https://junglewise.ai/threats/cve-2023-22578-sequelize-sql-injection-via-unescaped-parentheses-in-attributes)
- [Sequelize unsafe fall-through in getWhereConditions](https://junglewise.ai/threats/cve-2023-22579-sequelize-unsafe-fall-through-in-getwhereconditions)
- [Sequelize SQL injection via replacements](https://junglewise.ai/threats/cve-2023-25813-sequelize-sql-injection-via-replacements)