CVE-2026-30951

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30951
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/sequelize/sequelize/security/advisories/GHSA-6457-6jrx-69cr
Configurations

No configuration.

History

11 Mar 2026, 13:52

Type Values Removed Values Added
Summary
  • (es) Sequelize es una herramienta ORM para Node.js. Antes de la 6.37.8, existe una inyección SQL mediante un tipo de conversión (cast) sin escapar en el procesamiento de cláusulas WHERE de JSON/JSONB. La función _traverseJSON() divide las claves de ruta JSON en :: para extraer un tipo de conversión (cast), el cual se interpola directamente en el SQL CAST(... AS ). Un atacante que controla las claves de objetos JSON puede inyectar SQL arbitrario y exfiltrar datos de cualquier tabla. Esta vulnerabilidad está corregida en la versión 6.37.8.

10 Mar 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 21:16

Updated : 2026-03-11 13:52

NVD link : CVE-2026-30951

Mitre link : CVE-2026-30951

CVE.ORG link : CVE-2026-30951

JSON object : View

Products Affected

No product.

CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')