Prototype Pollution Affecting feathers-sequelize package, versions >=6.0.0 <6.3.4
Threat Intelligence
EPSS
0.56% (79th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-FEATHERSSEQUELIZE-3063744
- published 7 Nov 2022
- disclosed 26 Oct 2022
- credit Thomas Rinsma, Kevin Valk
Introduced: 26 Oct 2022
CVE-2022-29823 Open this link in a new tabHow to fix?
Upgrade feathers-sequelize to version 6.3.4 or higher.
Overview
feathers-sequelize is an A service adapter for Sequelize an SQL ORM
Affected versions of this package are vulnerable to Prototype Pollution due to the cleanQuery method, which uses insecure recursive logic to filter unsupported keys from the query object.
References
CVSS Scores
version 3.1