Sequelize v6.37.3 SQL Injection Vulnerability: Early Warning
An early warning has been issued regarding a potential SQL injection vulnerability in Sequelize v6.37.3 when the dialect is set to 'oracle'. Users of this version are advised to assess their exposure and prepare for a potential upgrade.
What happened
Reportedly, Sequelize v6.37.3 is under investigation for a critical SQL injection vulnerability when the dialect is configured to 'oracle'. This issue, tracked as GHSA-V8FG-2RW7-Q452, appears to allow an attacker to inject arbitrary SQL expressions, potentially leading to unauthorized data access or manipulation.
To assess your exposure, review your application's usage of Sequelize, particularly instances where the dialect is set to 'oracle'. It is recommended to upgrade to a patched version of Sequelize once it becomes available and to scrutinize your queries for potential injection points.
For more detailed information, consult the primary source at [GHSA-v8fg-2rw7-q452] Sequelize: SQL Injection (Oracle DB). Stay tuned for further updates as the situation develops.
How 0Day mitigates this
sequelize is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.