Description
Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.
Remediation
References
https://csirt.divd.nl/CVE-2022-29823/
https://csirt.divd.nl/DIVD-2022-00020
Related Vulnerabilities
CVE-2020-28196 Vulnerability in npm package krb5
CVE-2020-5230 Vulnerability in maven package org.opencastproject:base
CVE-2019-10314 Vulnerability in maven package org.jenkins-ci.plugins:koji
CVE-2018-6561 Vulnerability in maven package org.webjars.bowergithub.dojo:dijit
CVE-2021-29425 Vulnerability in maven package commons-io:commons-io