-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @sequelize/core | npm | < 7.0.0-alpha.20 | 7.0.0-alpha.20 |
| sequelize | npm | < 6.29.0 | 6.29.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how Sequelize processes the attributes option in query methods like findAll. The attributeToSQL function in the query generator is responsible for converting attribute definitions into SQL fragments. In vulnerable versions, attributes with parentheses (e.g., count(id)) were treated as raw SQL instead of being escaped as identifiers. This allowed attackers to inject arbitrary SQL via user-controlled input in the attributes array. The patch in v6.29.0 introduced explicit checks for parentheses in this function, and v7.0.0 enforced escaping. The function's role in attribute processing and the patch's focus on it confirm its vulnerability.