Skip to content
OpenAdvisories

Package · npm

sequelize

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-30951 Public exploit

    Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

    Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS…

    sequelize sequelize sequelize npm
  • High —
    GHSA-wfp9-vr4j-f49j

    NoSQL Injection in sequelize

    Versions of `sequelize` prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as `$gt` are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection. ## Recommendation Upgrade to version 4.12.0 or lat…

    sequelize npm
  • High 7.5
    CVE-2019-11069

    SQL Injection in sequelize

    Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.

    sequelize npm
  • High —
    CVE-2016-10550

    SQL Injection in sequelize

    sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their…

    HackerOne sequelize node module sequelize npm
  • High —
    CVE-2016-10553

    Potential SQL Injection in sequelize

    sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.

    HackerOne sequelize node module sequelize npm
  • High 7.5
    CVE-2016-10556

    SQL Injection in sequelize

    sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as …

    HackerOne sequelize node module sequelize npm
  • High —
    CVE-2015-1369

    SQL Injection in sequelize

    SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.

    sequelize npm