Skip to content
OpenAdvisories

Vendor

sequelize

3 known vulnerabilities.

Products

sequelize 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-30951 Public exploit

    Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

    Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS…

    sequelize sequelize sequelize npm