Update dependency sequelize to v6 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
sequelize (source)	^5.15.1 → ^6.0.0

---

Sequelize information disclosure vulnerability

CVE-2023-22580 / GHSA-8c25-f3mj-v6h8

More information

Details

Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-22580
• https://csirt.divd.nl/CVE-2023-22580
• https://csirt.divd.nl/DIVD-2022-00020/
• https://github.com/sequelize/sequelize/pull/15375
• https://github.com/sequelize/sequelize/pull/15699
• https://github.com/sequelize/sequelize/releases/tag/v6.28.1
• https://github.com/sequelize/sequelize/releases/tag/v7.0.0-alpha.20
• https://github.com/advisories/GHSA-8c25-f3mj-v6h8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Sequelize vulnerable to SQL Injection via replacements

CVE-2023-25813 / GHSA-wrh9-cjv3-2hpw

More information

Details

Impact

The SQL injection exploit is related to replacements. Here is such an example:

In the following query, some parameters are passed through replacements, and some are passed directly through the where option.

User.findAll({
  where: or(
    literal('soundex("firstName") = soundex(:firstName)'),
    { lastName: lastName },
  ),
  replacements: { firstName },
})

This is a very legitimate use case, but this query was vulnerable to SQL injection due to how Sequelize processed the query: Sequelize built a first query using the where option, then passed it over to sequelize.query which parsed the resulting SQL to inject all :replacements.

If the user passed values such as

{
  "firstName": "OR true; DROP TABLE users;",
  "lastName": ":firstName"
}

Sequelize would first generate this query:

SELECT * FROM users WHERE soundex("firstName") = soundex(:firstName) OR "lastName" = ':firstName'

Then would inject replacements in it, which resulted in this:

SELECT * FROM users WHERE soundex("firstName") = soundex('OR true; DROP TABLE users;') OR "lastName" = ''OR true; DROP TABLE users;''

As you can see this resulted in arbitrary user-provided SQL being executed.

Patches

The issue was fixed in Sequelize 6.19.1

Workarounds

Do not use the replacements and the where option in the same query if you are not using Sequelize >= 6.19.1

References

See this thread for more information: https://github.com/sequelize/sequelize/issues/14519

Snyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-2932027

Severity

• CVSS Score: 10.0 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://github.com/sequelize/sequelize/security/advisories/GHSA-wrh9-cjv3-2hpw
• https://nvd.nist.gov/vuln/detail/CVE-2023-25813
• https://github.com/sequelize/sequelize/issues/14519
• https://github.com/sequelize/sequelize/commit/ccaa3996047fe00048d5993ab2dd43ebadd4f78b
• https://github.com/sequelize/sequelize/releases/tag/v6.19.1
• https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-2932027
• https://github.com/advisories/GHSA-wrh9-cjv3-2hpw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Unsafe fall-through in getWhereConditions

CVE-2023-22579 / GHSA-vqfx-gj96-3w95

More information

Details

Impact

Providing an invalid value to the where option of a query caused Sequelize to ignore that option instead of throwing an error.

A finder call like the following did not throw an error:

User.findAll({
  where: new Date(),
});

As this option is typically used with plain javascript objects, be aware that this only happens at the top level of this option.

Patches

This issue has been patched in sequelize@6.28.1 & @sequelize/core@7.0.0.alpha-20

References

A discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15698

CVE: CVE-2023-22579
Snyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-3324090

Severity

• CVSS Score: 9.9 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

• https://github.com/sequelize/sequelize/security/advisories/GHSA-vqfx-gj96-3w95
• https://nvd.nist.gov/vuln/detail/CVE-2023-22579
• https://github.com/sequelize/sequelize/pull/15375
• https://github.com/sequelize/sequelize/pull/15699
• https://csirt.divd.nl/CVE-2023-22579
• https://csirt.divd.nl/DIVD-2022-00020/
• https://github.com/sequelize/sequelize/discussions/15698
• https://github.com/sequelize/sequelize/releases/tag/v6.28.1
• https://github.com/sequelize/sequelize/releases/tag/v7.0.0-alpha.20
• https://github.com/advisories/GHSA-vqfx-gj96-3w95

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Sequelize - Default support for “raw attributes” when using parentheses

CVE-2023-22578 / GHSA-f598-mfpv-gmfx

More information

Details

Impact

Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL

User.findAll({
  attributes: [
    ['count(id)', 'count']
  ]
});

Produced

SELECT count(id) AS "count" FROM "users"

Patches

This feature was deprecated in Sequelize 5, and using it prints a deprecation warning.

This issue has been patched in @sequelize/core@7.0.0.alpha-20 and sequelize@6.29.0.

In Sequelize 7, it now produces the following:

SELECT "count(id)" AS "count" FROM "users"

In Sequelize 6, it throws an error explaining that we had to introduce a breaking change, and requires the user to explicitly opt-in to either the Sequelize 7 behavior (always escape) or the Sequelize 5 behavior (inline attributes that include () without escaping). See https://github.com/sequelize/sequelize/pull/15710 for more information.

Mitigations

Do not use user-provided content to build your list or attributes. If you do, make sure that attribute in question actually exists on your model by checking that it exists in the rawAttributes property of your model first.

---

A discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15694
CVE: CVE-2023-22578

Severity

• CVSS Score: 10.0 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://github.com/sequelize/sequelize/security/advisories/GHSA-f598-mfpv-gmfx
• https://nvd.nist.gov/vuln/detail/CVE-2023-22578
• https://github.com/sequelize/sequelize/pull/15710
• https://csirt.divd.nl/CVE-2023-22578
• https://csirt.divd.nl/DIVD-2022-00020/
• https://github.com/sequelize/sequelize/discussions/15694
• https://github.com/sequelize/sequelize/releases/tag/v6.29.0
• https://github.com/sequelize/sequelize/releases/tag/v7.0.0-alpha.20
• https://github.com/advisories/GHSA-f598-mfpv-gmfx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Sequelize: SQL Injection (Oracle DB)

CVE-2026-69240 / GHSA-v8fg-2rw7-q452

More information

Details

Summary

SQL Injection is possible with strings only if dialect is set to oracle.
The vulnerability was confirmed on Sequelize v6.37.3.

Details

The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE.

  } else if (dialect === 'oracle' && typeof val === 'string') {
    if (val.startsWith('TO_TIMESTAMP') || val.startsWith('TO_DATE')) {
      return val;
    }
    val = val.replace(/'/g, "''");
  }

PoC

Suppose the application has the following code:

  var result = await models.Student.findOne({
    where: {
      firstName: req.query.firstName
    }
  });

An attacker can inject arbitrary sql expressions.

http://host/path?firstName=TO_DATE('0','Y')||'' OR 1=1--

The resulted SQL will be:

SELECT ... WHERE "Student"."firstName" = TO_DATE('0','Y')||'' OR 1=1-- ORDER BY "Student"."id" OFFSET 0 ROWS FETCH NEXT 1 ROWS ONLY;

Impact

Data theft and tampering.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452
• https://github.com/sequelize/sequelize/commit/5deadd2410ae9136a21fb652db206d27bb715f26
• https://github.com/sequelize/sequelize/releases/tag/v6.37.4
• https://github.com/advisories/GHSA-v8fg-2rw7-q452

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sequelize/sequelize (sequelize)

v6.37.4

Compare Source

Bug Fixes

• oracle: add support for Oracle Database 23ai (#​17345) (b9e71a7)
• oracle: validate input with TO_TIMESTAMP_TZ and TO_DATE (#​17516) (5deadd2)

v6.37.3

Compare Source

Bug Fixes

• postgres: use schema for foreign key constrains of a table (#​17099) (6aba382)

v6.37.2

Compare Source

Bug Fixes

• add readOnly to the transaction options types and docs (#​17226) (7c8972f)

v6.37.1

Compare Source

Bug Fixes

• types: Add definition of returning in SaveOptions. (#​16954) (505467b)

v6.37.0

Compare Source

Features

• postgres: support connectionTimeoutMillis dialectOption (#​14119) (e81200e)

v6.36.0

Compare Source

Features

• postgres: backport stream dialectOption to v6 (#​16868) (a250058)

v6.35.2

Compare Source

Bug Fixes

• sort keys by depth in groupJoinData (#​16823) (cb8ea88)

v6.35.1

Compare Source

Bug Fixes

• mssql: allow calling describeTable a table with a dot in its name (#​16769) (47cba67)

v6.35.0

Compare Source

Features

• backport findModel to v6 (#​16705) (5bfbb99)

v6.34.0

Compare Source

Bug Fixes

• oracle: add missing default and not null condition to addColumn (#​16619) (b204b5f)
• oracle: clean constraints (#​16694) (6c03176)

Features

• oracle: add support for lock (#​16643) (b284d37)

v6.33.0

Compare Source

Bug Fixes

• types: remove escape from query-interface types (#​15944) (2eb7a5d)

Features

• types: add TypeScript 5.2 support (#​16442) (367caf3)

v6.32.1

Compare Source

Bug Fixes

• bump dependencies (#​16119) (a3213f0)

v6.32.0

Compare Source

Bug Fixes

• move types condition to the front (#​16085) (99c3530)
• oracle: For Raw queries avoid converting the input parameters passed (#​16067) (fd38e79)
• oracle: reordered check constraint for unsigned numeric type (#​16074) (5c8250e)

Features

• oracle: add new error messages introduced in new driver version (#​16075) (e07eefb)
• oracle: add width support for numerictype (#​16073) (af4f0ae)

v6.31.1

Compare Source

Bug Fixes

• postgres: adds support for minifying through join aliases (#​15897) (a9fd501)

v6.31.0

Compare Source

Bug Fixes

• postgres: prevent crash if postgres connection emits multiple errors (#​15868) (58576dd)
• update Slack invitation link (#​15849) (9d864be)

Features

• add beforePoolAcquire and afterPoolAcquire hooks (#​15874) (f2a4535)

v6.30.0

Compare Source

Bug Fixes

• pass CLS transaction to model hooks (#​15818) (46d3553)

Features

• postgres, sqlite: add conflictWhere option to Model.bulkCreate (#​15788) (295c297)
• postgres, sqlite: add conflictWhere option to upsert (#​15786) (1e68681)
• postgres, sqlite: allow override of conflict keys for bulkCreate (#​15787) (2e50bd9)

v6.29.3

Compare Source

Bug Fixes

• fix unnamed dollar string detection (#​15759) (5bda2ce)

v6.29.2

Compare Source

Bug Fixes

• postgres: escape identifier in createSchema and dropSchema (#​15752) (1ad9a64), closes #​15651 #​14999

v6.29.1

Compare Source

Bug Fixes

• postgres: make sync not fail when trying to create existing enum (#​15718) (1b94462)

v6.29.0

Compare Source

Features

• throw an error if attribute includes parentheses (fixes CVE-2023-22578) (#​15710) (d3f5b5a)

v6.28.2

Compare Source

Bug Fixes

• accept undefined in where (#​15703) (13f2e89)

v6.28.1

Compare Source

Bug Fixes

• throw if where receives an invalid value (#​15699) (d9e0728)
• update moment-timezone version (#​15685) (48d6193)

v6.28.0

Compare Source

Features

• types: use retry-as-promised types for retry options to match documentation (#​15484) (fd4afa6)

v6.27.0

Compare Source

Features

• add support for bigints (backport of #​14485) (#​15413) (1247c01)

v6.26.0

Compare Source

Features

• postgres: add support for lock_timeout [#​15345] (#​15355) (94beace)

v6.25.8

Compare Source

Bug Fixes

• oracle: remove hardcoded maxRows value (#​15323) (7885000)

v6.25.7

Compare Source

Bug Fixes

• fix parameters not being replaced when after $$ strings (#​15307) (bc39fd6)

v6.25.6

Compare Source

Bug Fixes

• postgres: invalidate connection after client-side timeout (#​15283) (a205765), closes /github.com/brianc/node-postgres/blob/5538df6b446f4b4f921947b460fe38acb897e579/packages/pg/lib/client.js#L529

v6.25.5

Compare Source

Bug Fixes

• remove options.model overwrite on bulkUpdate (#​15252) (67e69cd), closes #​15231

v6.25.4

Compare Source

Bug Fixes

• types: add instance.dataValues property to model.d.ts (#​15240) (00c6da3)

v6.25.3

Compare Source

Bug Fixes

• don't treat \ as escape in standard strings, support E-strings, support vars after ->> operator, treat lowercase e as valid e-string prefix (#​15139) (7990095), closes #​14700

v6.25.2

Compare Source

Bug Fixes

• types: fix TS 4.9 excessive depth error on InferAttributes (v6) (#​15135) (851daaf)

v6.25.1

Compare Source

Bug Fixes

• types: expose legacy "types" folder in export alias ( #​15123) (9dd93b8)

v6.25.0

Compare Source

Features

• oracle: add support for dialectOptions.connectString (#​15042) (06ad05d)

v6.24.0

Compare Source

Features

• snowflake: Add support for QueryGenerator#tableExistsQuery (#​15087) (a44772e)

v6.23.2

Compare Source

Bug Fixes

• postgres: add custom order direction to subQuery ordering with minified alias (#​15056) (7203b66)

v6.23.1

Compare Source

Bug Fixes

• oracle: add support for Oracle DB 18c CI (#​15016) (5f621d7), closes #​1 #​7 #​9 #​13 #​14 #​16

v6.23.0

Compare Source

Features

• types: add typescript 4.8 compatibility (#​14990) (3468378)

v6.22.1

Compare Source

Bug Fixes

• types: missing type for oracle dialect in v6 (#​14992) (1da6657), closes #​14991

v6.22.0

Compare Source

Features

• oracle: add oracle dialect support (#​14638) (c230d80), closes #​1 #​7 #​9 #​13 #​14 #​16

v6.21.6

Compare Source

Bug Fixes

• types: backport #​14704 for v6 (#​14964) (33d94b2)

v6.21.5

Compare Source

Bug Fixes

• mariadb: do not automatically parse JSON fields (#​14800) (d047f32)

v6.21.4

Compare Source

Bug Fixes

• minified aliases are now properly referenced in subqueries (v6) (#​14852) (5a257bc), closes #​14804

v6.21.3

Compare Source

Bug Fixes

• postgres: attach postgres error-handler earlier in lifecycle (v6) (#​14731) (90bb694)

v6.21.2

Compare Source

Bug Fixes

• properly escape multiple $ in fn args (#​14678) (7bb60e3)

v6.21.1

Compare Source

Bug Fixes

• postgres: use schema set in sequelize config by default (#​14665) (2f3b924)

v6.21.0

Compare Source

Features

• exports types to support typescript >= 4.5 nodenext module (#​14620) (cbdf73e)

v6.20.1

Compare Source

Bug Fixes

• kill connection on commit/rollback error (#​14535) (e1a9c28)

v6.20.0

Compare Source

Features

• support cyclic foreign keys (#​14499) (b37df96)

v6.19.2

Compare Source

Bug Fixes

• accept replacements in ARRAY[] & followed by ; (#​14518) (e37c572)

v6.19.1

Compare Source

Bug Fixes

• do not replace :replacements inside of strings (#​14472) (ccaa399)

⚠️ BREAKING CHANGE: This change is a security fix that patches a serious SQL injection vulnerability, however it is possible that your application made use of it and broke as a result of this change. Please see this issue for more information.

v6.19.0

Compare Source

Bug Fixes

• types: make WhereOptions more accurate (#​14368) (0d0aade)

Features

• types: make Model.init aware of pre-configured foreign keys (#​14370) (5954d2c)

v6.18.0

Compare Source

Features

• add whereScopeStrategy to merge where scopes with Op.and (#​14152) (8349c02)

v6.17.0

Compare Source

Bug Fixes

• fix typo in query-generator.js error message (#​14151) (2d339d0)
• postgres: correctly re-acquire connection for pg-native (#​14090) (82506a6)
• types: drop excess argument for upsert (#​14156) (da8678d)
• types: export GroupedCountResultItem interface (#​14154) (a81b7ab)
• types: update 'replication' option property (#​14126) (7ac1221)
• types: update return type of Model.update (#​14155) (b80aeed)

Features

• types: infer nullable creation attributes as optional (#​14147) (f5c06bd)
• types: make Model.getAttributes stricter (#​14017) (e974e20)

v6.16.3

Compare Source

Bug Fixes

• types: support union in CreationAttributes (#​14146) (d23bd7a)

v6.16.2

Compare Source

Bug Fixes

• types: missing snowflake and db2 dialects (#​14137) (0326c2c)

v6.16.1

Compare Source

Bug Fixes

• correct path to package.json in Sequelize.version (#​14073) (b95c213)

v6.16.0

Compare Source

Features

• gen /lib & /types from /src & drop /dist (v6) (#​14063) (6b8fbb4)

v6.15.1

Compare Source

Bug Fixes

• types: accept $nested.syntax$ in WhereAttributeHash (#​13983) (4a513cf)
• types: correct typing definitions for Sequelize.where (#​14018) (99c612b)
• types: improve branded types (#​13990) (a578ea0)

v6.15.0

Compare Source

Bug Fixes

• types: deduplicate error typings (#​14002) (fc28629)

Features

• add options.rawErrors to Sequelize#query method (#​13881) (7c58851)

v6.14.1

Compare Source

Bug Fixes

• rollback PR #​13951 in v6 (#​14004) (1882f3c)

v6.14.0

Compare Source

Bug Fixes

• don't call overloaded versions of find functions internally (#​13951) (fc53cdb)
• don't call overloaded versions of find functions internally (#​13951) (b253d8e)
• model.d: fix type for count and findAndCountAll (#​13786) (b06c1fc)
• types: add hooks to InstanceDestroyOptions type (#​13491) (dbd9ea8)
• types: add missing fields to FindOr{Create,Build}Options (#​13389) (ef63f8f)
• types: fix QueryInterface#bulkInsert attribute arg type (#​13945) (9e108e3)

Features

• types: add InferAttributes utility type (#​13909) (fd42687)
• types: add typings for DataTypes.TSVECTOR (#​13940) (b8f0463)
• types: drop TypeScript < 4.1 (#​13954) (dd49044)

v6.13.0

Compare Source

Bug Fixes

• fix typings for queries with {plain: true} option (#​13899) (308d017)

Features

• mariadb: add mariadb support in Sequelize.set function (#​13926) (02bda05), closes #​13920
• postgres: drop indices concurrently in Postgres (#​13903) (37f20a6)

v6.12.5

Compare Source

Bug Fixes

• dialect: sequelize pool doesn't take effect in dialect "mssql" (#​13880) (fc155b6)
• model: fix count with grouping typing (#​13884) (49beb29), closes #​13871
• types: improve ModelCtor / ModelStatic typing (#​13890) (34aa808)
• types: omit FK and scope keys in HasManyCreateAssociationMixin (#​13892) (b315ce8)

v6.12.4

Compare Source

Bug Fixes

• mssql/async-queue: fix unable to start mysql due to circular ref (#​13823) (49e8614)

v6.12.3

Compare Source

Bug Fixes

• data-types: moment object throwing error (#​13818) (78c7414)

v6.12.2

Compare Source

Bug Fixes

• abstract: patch jsonb operator for pg if value is json (#​13780) (a2375c5)
• operators: fix ts support for operators.ts (#​13805) (b532ab1)
• postgres: allows usage of schema for ARRAY(ENUM) type name (#​13807) (da5b0ce)
• query-interface: bring back quoteIdentifier(s) to queryInterface (#​13810) (001dc60)

v6.12.1

Compare Source

Bug Fixes

• allow deep imports (#​13795) (1ecdaf9)
• fix invalid ts import style of lib/operators (#​13797) (8acc14f)

v6.12.0

Compare Source

Bug Fixes

• data-types: unnecessary warning when getting data with DATE dataTypes (#​13712) (121884b)
• docs: add aws-lamda route ([#&update tslint to use recommended & project, --fix #8

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.