-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability title explicitly references 'getWhereConditions' as the source of unsafe fall-through behavior. The associated GitHub PRs (#15375 and #15699) show this function was modified to add type checks and throw errors. Prior to patching, the function's lack of input validation for the 'where' option's type allowed incompatible values to be processed as valid conditions, matching the CWE-843 (Type Confusion) description. The direct correlation between the vulnerability description, CWE classification, and patched functions confirms this assessment.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sequelize | npm | < 6.28.1 | 6.28.1 |
| @sequelize/core | npm | < 7.0.0-alpha.20 | 7.0.0-alpha.20 |