GHSA-r3vq-92c6-3mqf: Duplicate advisory: Sequelize - Unsafe fall-through in getWhereConditions
8.8
CVSS Score
3.1
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
Published
2/16/2023
Updated
4/28/2023
KEV Status
No
Technology
JavaScript
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
@sequelize/core | npm | < 7.0.0-alpha.20 | 7.0.0-alpha.20 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The advisory directly identifies getWhereConditions
as the vulnerable function through its title and description. This function processes WHERE clause conditions in Sequelize
queries. The type confusion (CWE-843) occurs when untrusted input passes through this function without proper validation
, allowing attackers to inject query logic. While no patch code is shown, the withdrawn advisory's explicit reference to this function name and the CWE type confusion pattern strongly indicate this is the primary vulnerable entry point for runtime detection.