Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-25813: Sequelize library could let attackers change data

CVE-2023-25813 · published 2 days ago

Summary

Certain versions of the Sequelize JavaScript library (including the wikirik/sequelize, sequelizejs/sequelize and rootio/@rootio/sequelize packages) contain a coding error that could allow a malicious user to alter or delete database information. This could compromise the integrity of your applications that rely on Sequelize for data storage. Update to the latest released versions of these packages as soon as possible to apply the fix.

What to do

Update wikirik sequelize to version 6.19.1.
Update sequelize to version 5.22.4-aikido.1.
Update rootio @rootio/sequelize to version 5.22.4-root.io.1.
Update sequelize to version 6.7.0-aikido.1.
Update rootio @rootio/sequelize to version 6.7.0-root.io.1.
Update sequelize to version 4.44.3-aikido.1.
Update rootio @rootio/sequelize to version 4.44.3-root.io.1.
Update sequelize to version 6.3.5-aikido.2.
Update rootio @rootio/sequelize to version 6.3.5-root.io.2.
Update sequelizejs sequelize to version 6.19.1 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	wikirik	sequelize	< 6.19.1 Fix: upgrade to 6.19.1
–	sequelizejs	sequelize	< 6.19.1 `cpe:2.3:a:sequelizejs:sequelize::::::node.js::*`
Root:npm	–	sequelize	< 5.22.4-aikido.1 < 6.7.0-aikido.1 < 4.44.3-aikido.1 < 6.3.5-aikido.2 Fix: upgrade to 5.22.4-aikido.1
Root:npm	rootio	@rootio/sequelize	< 5.22.4-root.io.1 < 6.7.0-root.io.1 < 4.44.3-root.io.1 < 6.3.5-root.io.2 Fix: upgrade to 5.22.4-root.io.1

Original advisory text

CVE-2023-25813 in sequelize - Patched by Root

Root has patched CVE-2023-25813 in the sequelize package for Root:npm. Multiple fixed versions available.

References

https://github.com/sequelize/sequelize/security/advisories/GHSA-wrh9-cjv3-2hpw Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-25813 Vendor Advisory
https://github.com/sequelize/sequelize/issues/14519 Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-2932027
https://github.com/advisories/GHSA-wrh9-cjv3-2hpw
https://github.com/sequelize/sequelize/releases/tag/v6.19.1 URL
https://github.com/sequelize/sequelize/commit/ccaa3996047fe00048d5993ab2dd43ebad... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25813... Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published6 Nov 2026

Updated6 Nov 2026

First seen6 Mar 2026

Sources

GHSA-wrh9-cjv3-2hpw · GHSA

CVE-2023-25813 · NVD

CVE-2023-25813 · OSV

ROOT-APP-NPM-CVE-2023-25813 · OSV

Track software like this

Free during beta