Vulnerability record · CVE-2023-25813 · published 22 February 2023

CVE-2023-25813: Sequelizejs sequelize sql injection vulnerability

Sequelizejs · Sequelize

Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fixed in Sequelize 6.19.1. Users are advised to upgrade. Users unable to upgrade should not use the `replacements` and the `where` option in the same query.

9.8 CVSS 3.1 Critical EPSS 1.4% · top 27.8% CWE-89 · SQL injection

9.8CVSS 3.1 base score

1.4%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 4 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Sequelize Sequelizejs

References

Link	Tags
https://github.com/sequelize/sequelize/commit/ccaa3996047fe00048d5993ab2dd43ebadd4f78b	Patch
https://github.com/sequelize/sequelize/issues/14519	ExploitIssue Tracking
https://github.com/sequelize/sequelize/releases/tag/v6.19.1	Release Notes
https://github.com/sequelize/sequelize/security/advisories/GHSA-wrh9-cjv3-2hpw	ExploitVendor Advisory
https://github.com/sequelize/sequelize/commit/ccaa3996047fe00048d5993ab2dd43ebadd4f78b	Patch
https://github.com/sequelize/sequelize/issues/14519	ExploitIssue Tracking
https://github.com/sequelize/sequelize/releases/tag/v6.19.1	Release Notes
https://github.com/sequelize/sequelize/security/advisories/GHSA-wrh9-cjv3-2hpw	ExploitVendor Advisory

Track CVE-2023-25813 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-22578Sequelizejs sequelize vulnerabilityDue to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.EPSS 0.83%16 Feb 2023 9.8CVE-2019-10748Sequelizejs sequelize sql injection vulnerabilitySequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the M…EPSS 1.3%29 Oct 2019 9.8CVE-2019-10749Sequelizejs sequelize sql injection vulnerabilitysequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres di…EPSS 1.2%29 Oct 2019 9.8CVE-2019-10752Sequelizejs sequelize sql injection vulnerabilitySequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping value…EPSS 1.5%17 Oct 2019 9.8CVE-2016-10554Sequelizejs sequelize sql injection vulnerabilitysequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usabl…EPSS 1.9%31 May 2018 9.8CVE-2016-10550Sequelizejs sequelize sql injection vulnerabilitysequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usabl…EPSS 1.9%31 May 2018 9.8CVE-2016-10553Sequelizejs sequelize sql injection vulnerabilitysequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usabl…EPSS 1.3%31 May 2018 8.8CVE-2023-22579Sequelizejs sequelize type confusion vulnerabilityDue to improper parameter filtering in the sequalize js library, can a attacker peform injection.EPSS 0.81%16 Feb 2023

Source: NIST National Vulnerability Database (record CVE-2023-25813), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.