CVE-2026-30951
Received Received - Intake
SQL Injection in Sequelize JSONB Cast Allows Data Exfiltration

Publication date: 2026-03-10

Last updated on: 2026-03-18

Assigner: GitHub, Inc.

Description
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-03-18
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-30951
EUVD
EUVD-2026-10870
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
sequelizejs sequelize to 6.37.8 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Sequelize, a Node.js ORM tool, prior to version 6.37.8. It involves SQL injection through unescaped cast types in JSON/JSONB where clause processing. Specifically, the _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is then directly interpolated into the SQL CAST statement without proper escaping. An attacker who can control JSON object keys can exploit this to inject arbitrary SQL commands.

This allows the attacker to execute unauthorized SQL queries and potentially exfiltrate data from any database table.

Impact Analysis

The vulnerability can lead to unauthorized data access and data exfiltration from your database. Since an attacker can inject arbitrary SQL, they may retrieve sensitive information from any table, compromising confidentiality.

The CVSS score of 7.5 indicates a high severity, meaning the vulnerability is exploitable remotely without authentication and can cause significant data breaches.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, upgrade Sequelize to version 6.37.8 or later, where the SQL injection issue via unescaped cast type in JSON/JSONB where clause processing is fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-30951. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart