CVE-2026-30951

EUVD-2026-10870
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Affected Products (NVD)
VendorProductVersion
sequelizejssequelize
𝑥
< 6.37.8
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Satellite 6.18
1776194798 ≤
𝑥
< *
ADP
Common Weakness Enumeration
References
https://github.com/sequelize/sequelize/security/advisories/GHSA-6457-6jrx-69cr
https://access.redhat.com/errata/RHSA-2026:8498
https://access.redhat.com/security/cve/CVE-2026-30951
https://bugzilla.redhat.com/show_bug.cgi?id=2446250
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-30951.json