← Vulnerability feed

Vulnerability record · CVE-2026-30951 · published 10 March 2026

CVE-2026-30951: Sequelizejs sequelize sql injection vulnerability

Sequelizejs · Sequelize

Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.

7.5 CVSS 3.1 High EPSS 0.48% · top 61.1% CWE-89 · SQL injection
7.5CVSS 3.1 base score
0.48%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 1 tagged exploit
15 Jul 2026Last modified by NVD

Description

Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/sequelize/sequelize/security/advisories/GHSA-6457-6jrx-69cr ExploitMitigationVendor Advisory
https://access.redhat.com/errata/RHSA-2026:8498
https://access.redhat.com/security/cve/CVE-2026-30951
https://bugzilla.redhat.com/show_bug.cgi?id=2446250
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-30951.json

Track CVE-2026-30951 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-25813Sequelizejs sequelize sql injection vulnerabilitySequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed thro…EPSS 1.4%9.8CVE-2023-22578Sequelizejs sequelize vulnerabilityDue to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.EPSS 0.83%9.8CVE-2019-10748Sequelizejs sequelize sql injection vulnerabilitySequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the M…EPSS 1.3%9.8CVE-2019-10749Sequelizejs sequelize sql injection vulnerabilitysequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres di…EPSS 1.2%9.8CVE-2019-10752Sequelizejs sequelize sql injection vulnerabilitySequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping value…EPSS 1.5%9.8CVE-2016-10554Sequelizejs sequelize sql injection vulnerabilitysequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usabl…EPSS 1.9%9.8CVE-2016-10550Sequelizejs sequelize sql injection vulnerabilitysequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usabl…EPSS 1.9%9.8CVE-2016-10553Sequelizejs sequelize sql injection vulnerabilitysequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usabl…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2026-30951), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.