Skip to content
OpenAdvisories

Vendor

sequelize

3 known vulnerabilities.

Products

sequelize 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-30951 Public exploit

    Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

    Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS…

    sequelize sequelize sequelize npm
  • Critical 10.0
    CVE-2023-25813 Public exploit

    SQL Injection via replacements in sequelize

    Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific …

    sequelize sequelize sequelize npm