Critical severity10.0NVD Advisory· Published Oct 26, 2022· Updated Jun 17, 2026

CVE-2022-29823

Description

Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
feathers-sequelizenpm	>= 6.0.0, < 6.3.3	6.3.3

Affected products

ghsa-coords
pkg:npm/feathers-sequelize
Range: >= 6.0.0, < 6.3.3
Feather Js/Feathers Sequalizev5
Range: 6.x

Patches

Vulnerability mechanics

References

csirt.divd.nl/CVE-2022-29823/nvdThird Party Advisory
csirt.divd.nl/DIVD-2022-00020nvdThird Party AdvisoryWEB
github.com/advisories/GHSA-p5m3-27vh-52j4ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-29823ghsaADVISORY
csirt.divd.nl/CVE-2022-29823ghsaWEB
csirt.divd.nl/cases/DIVD-2022-00020ghsaWEB
csirt.divd.nl/cves/CVE-2022-29823ghsaWEB
github.com/feathersjs-ecosystem/feathers-sequelize/commit/0b7beaa773dc313fdb27edd9ee8115064d7cf114ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.650
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000