PT-2026-24433 · Sequelize · Sequelize

Ethankim88 · Published 2026-03-10 · Updated 2026-04-27 · CVE-2026-30951

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sequelize versions prior to 6.37.8

Description Sequelize, a Node.js ORM tool, contains a SQL injection flaw due to unescaped cast type handling within JSON/JSONB where clause processing. The traverseJSON() function splits JSON path keys using '::' to determine a cast type, which is then directly incorporated into SQL queries using CAST(... AS <type>). An attacker controlling JSON object keys can inject arbitrary SQL code, potentially leading to data exfiltration from any table. The vulnerable component is the traverseJSON() function.

Recommendations Update to version 6.37.8 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-04971

CVE-2026-30951

GHSA-6457-6JRX-69CR

Affected Products

Sequelize

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30951.json · Exploit
• https://github.com/sequelize/sequelize/security/advisories/GHSA-6457-6jrx-69cr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30951 · Security Note
• https://bdu.fstec.ru/vul/2026-04971 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30951 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6457-6jrx-69cr · Vendor Advisory
• https://github.com/sequelize/sequelize · Note
• https://twitter.com/CVEnew/status/2031504122763997655 · Twitter Post
• https://twitter.com/EQSTLab/status/2048644955250598225 · Twitter Post