{"id":"CVE-2023-22579","aliases":["GHSA-vqfx-gj96-3w95"],"url":"https://o3.security/vulnerability/CVE-2023-22579","summary":"Sequalize - Unsafe fall-through in getWhereConditions","details":"### Impact\n\nProviding an invalid value to the `where` option of a query caused Sequelize to ignore that option instead of throwing an error. \n\nA finder call like the following did not throw an error:\n\n```ts\nUser.findAll({\n  where: new Date(),\n});\n```\n\nAs this option is typically used with plain javascript objects, be aware that this only happens at the top level of this option.\n\n### Patches\n\nThis issue has been patched in [`sequelize@6.28.1`](https://github.com/sequelize/sequelize/pull/15699) & [`@sequelize/core@7.0.0.alpha-20`](https://github.com/sequelize/sequelize/pull/15375)\n\n### References\n\nA discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15698\n\nCVE:  CVE-2023-22579\nSnyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-3324090","published":"2023-02-16T14:11:37.235Z","modified":"2026-08-12T03:51:24.838010255Z","cvss":{"score":9.9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"epss":{"score":0.00809,"percentile":0.53847,"asOf":"2026-08-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"sequelize","fixedVersion":"6.28.1"},{"ecosystem":"npm","name":"@sequelize/core","fixedVersion":"7.0.0-alpha.20"}],"fix":{"url":"https://github.com/sequelize/sequelize/pull/15375","label":"sequelize/sequelize#15375"},"references":[{"type":"WEB","url":"https://csirt.divd.nl/DIVD-2022-00020/"},{"type":"ADVISORY","url":"https://csirt.divd.nl/CVE-2023-22579"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22579.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22579"},{"type":"WEB","url":"https://github.com/sequelize/sequelize/security/advisories/GHSA-vqfx-gj96-3w95"},{"type":"WEB","url":"https://github.com/sequelize/sequelize/pull/15375"},{"type":"WEB","url":"https://github.com/sequelize/sequelize/pull/15699"},{"type":"WEB","url":"https://csirt.divd.nl/DIVD-2022-00020"},{"type":"PACKAGE","url":"https://github.com/sequelize/sequelize"},{"type":"WEB","url":"https://github.com/sequelize/sequelize/discussions/15698"},{"type":"WEB","url":"https://github.com/sequelize/sequelize/releases/tag/v6.28.1"},{"type":"WEB","url":"https://github.com/sequelize/sequelize/releases/tag/v7.0.0-alpha.20"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:24.838010255Z"}}