SQL Injection Affecting feathers-sequelize package, versions >=6.0.0 <6.3.4
Threat Intelligence
EPSS
0.18% (56th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-FEATHERSSEQUELIZE-3063745
- published 7 Nov 2022
- disclosed 26 Oct 2022
- credit Thomas Rinsma, Kevin Valk
Introduced: 26 Oct 2022
CVE-2022-29822 Open this link in a new tabHow to fix?
Upgrade feathers-sequelize to version 6.3.4 or higher.
Overview
feathers-sequelize is an A service adapter for Sequelize an SQL ORM
Affected versions of this package are vulnerable to SQL Injection due to improper parameter filtering, via raw attribute selects.
References
CVSS Scores
version 3.1