{"id":"GHSA-3xc7-xg67-pw99","aliases":[],"status":"published","title":"Sensitive Data Exposure in sequelize-cli","description":"Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text.\n\n\n## Recommendation\n\nUpgrade to version 5.5.0 or later.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-532"],"published":"2019-06-05T20:43:10Z","modified":"2023-01-09T05:01:42Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"sequelize-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.4.0"}]}]},{"source":"osv","ecosystem":"npm","package":"sequelize-cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"5.4.0"}]}]}],"references":[{"url":"https://github.com/sequelize/cli/issues/172","tags":["web"]},{"url":"https://github.com/sequelize/cli/pull/722","tags":["web"]},{"url":"https://github.com/FelixLC/cli/commit/da59652c061a798282e18efad0b6d0afefa15465","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-SEQUELIZECLI-174320","tags":["web"]},{"url":"https://www.npmjs.com/advisories/825","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3xc7-xg67-pw99"}],"sources":{"ghsa":[{"id":"GHSA-3xc7-xg67-pw99","title":"Sensitive Data Exposure in sequelize-cli","description":"Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text.\n\n\n## Recommendation\n\nUpgrade to version 5.5.0 or later.","status":"published","published":"2019-06-05T20:43:10Z","modified":"2023-01-09T05:01:42Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"osv":[{"id":"GHSA-3xc7-xg67-pw99","title":"Sensitive Data Exposure in sequelize-cli","description":"Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text.\n\n\n## Recommendation\n\nUpgrade to version 5.5.0 or later.","status":"published","published":"2019-06-05T20:43:10Z","modified":"2021-08-04T20:54:45Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:36.092962Z"}]}}