GHSA-6457-6jrx-69cr
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 11, 2026
CISA due date
—
The record
Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | sequelize | 6.0.0-beta.1 | 6.37.8 |
| Chainguard | sqlpad | 0 | 7.5.7-r14 |
| Wolfi | sqlpad | 0 | 7.5.7-r14 |
Related vulnerabilities
- CVE-2026-30951 Sequelize is a Node.js ORM tool. Same vulnerability
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects sqlpad
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects sqlpad
- CVE-2026-33750 The brace-expansion library generates arbitrary strings containing a common prefix and… Also affects sqlpad
- GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion Also affects sqlpad
- GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath Also affects sqlpad
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Also affects sqlpad
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects sqlpad