CVE-2026-30951
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Mar 10, 2026
CISA due date
—
The record
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | sequelize | 6.0.0-beta.1 | 6.37.8 |
| Chainguard | sqlpad | 0 | 7.5.7-r14 |
| Wolfi | sqlpad | 0 | 7.5.7-r14 |
Related vulnerabilities
- GHSA-6457-6jrx-69cr Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type Same vulnerability
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects sqlpad
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects sqlpad
- CVE-2026-33750 The brace-expansion library generates arbitrary strings containing a common prefix and… Also affects sqlpad
- GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion Also affects sqlpad
- GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath Also affects sqlpad
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Also affects sqlpad
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects sqlpad