SQL Injection in Sequelize ORM for Node.js Affects Multiple Versions
CVE-2026-30951
Key Information:
Badges
What is CVE-2026-30951?
Sequelize, a popular Object-Relational Mapping (ORM) tool for Node.js, exhibits a vulnerability that allows an attacker to exploit SQL injection through unescaped cast types in JSON/JSONB where clause processing. By manipulating JSON path keys, an attacker can inject malicious SQL queries, potentially leading to unauthorized data access and exfiltration from any associated database table. This issue is addressed in versions 6.37.8 and later, emphasizing the need for users to upgrade to ensure their systems remain secure.
Affected Version(s)
sequelize >= 6.0.0-beta.1, < 6.37.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.