CVE-2026-30951 Details
Description
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.
A SQL injection vulnerability has been identified in Sequelize, a Node.js ORM, in versions through 6.37.7. The issue arises from unescaped cast types in JSON/JSONB 'where' clause processing. The vulnerability allows an attacker to inject arbitrary SQL and exfiltrate data from any table by manipulating JSON object keys. The flaw is rooted in the '_traverseJSON()' function, which improperly handles cast types by interpolating them directly into SQL without validation. This vulnerability is present in all Sequelize dialects that support JSON, including SQLite, PostgreSQL, MySQL, and MariaDB.
Users are advised to update Sequelize to version 6.37.8 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:8498 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-30951 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2446250 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-30951.json | redhat-SADP | |
| https://github.com/sequelize/sequelize/security/advisories/GHSA-6457-6jrx-69cr | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | redhat-SADP |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sequelizejs sequelize | < 6.37.8 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |