# Sequelize unsafe fall-through in getWhereConditions

Source: https://junglewise.ai/threats/sequelize-unsafe-fall-through-in-getwhereconditions-4ab8ddc2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-02-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2023-02-16

Sequelize, a popular ORM (Object-Relational Mapping) library for Node.js, contains an unsafe parameter handling flaw in its query condition filtering. An attacker with access to application logic could craft malicious input to inject unfiltered database queries, potentially allowing unauthorized data access or modification.

Technologies: [@sequelize/core (npm)](https://junglewise.ai/threats/technologies/sequelize-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 16 February 2023.

**Which products and versions are affected?** @sequelize/core (npm) SEMVER:introduced=0,fixed=7.0.0-alpha.20.

**Is there a fix for This vulnerability?** Yes. @sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run @sequelize/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @sequelize/core (npm): upgrade to 7.0.0-alpha.20 or later

  ```sh
  npm install @sequelize/core@7.0.0-alpha.20
  ```


## Technical details

The vulnerability is a result of improper parameter filtering in Sequelize's getWhereConditions function, leading to an unsafe fall-through condition (CWE-843). This allows database injection attacks when user-controlled input is not properly sanitized before being used in query construction. Exploitation requires application context where user input flows into Sequelize query builders without adequate validation. The vulnerability affects all versions prior to 7.0.0-alpha.20 of @sequelize/core. An attacker can bypass filtering mechanisms to inject arbitrary database commands, potentially achieving unauthorized data exfiltration or modification.

## Affected products

- Sequelize @sequelize/core <7.0.0-alpha.20

## Timeline

- 2023-02-16: disclosed
- 2023-02-23: patched: Advisory withdrawn as duplicate of GHSA-vqfx-gj96-3w95; fix released in 7.0.0-alpha.20

## References

- [https://csirt.divd.nl/CVE-2023-22579](https://csirt.divd.nl/CVE-2023-22579)

## Related threats

- [Sequelize SQL injection via unescaped parentheses in attributes](https://junglewise.ai/threats/cve-2023-22578-sequelize-sql-injection-via-unescaped-parentheses-in-attributes)
- [Sequelize unsafe fall-through in getWhereConditions](https://junglewise.ai/threats/cve-2023-22579-sequelize-unsafe-fall-through-in-getwhereconditions)
- [Sequelize SQL injection via improper attribute filtering](https://junglewise.ai/threats/sequelize-sql-injection-via-improper-attribute-filtering-12e6c501)
- [Sequelize information disclosure via improper input filtering](https://junglewise.ai/threats/cve-2023-22580-sequelize-information-disclosure-via-improper-input-filtering)