CVE-2026-69240

A flaw was found in Sequelize. When configured to use an Oracle database, the Sequelize Node.js Object-Relational Mapper ORM tool fails to properly escape certain date and timestamp values. This oversight allows a remote attacker to bypass security filters. By injecting malicious SQL commands, an...

Linux Distros Unpatched Vulnerability : CVE-2026-69240

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in...

CVE-2026-69240

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. In the Oracle dialect, when val is a string and starts wit...

SQL Injection

Overview sequelize is a promise-based Node.js ORM for Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server. Affected versions of this package are vulnerable to SQL Injection via the escape function. An attacker can execute arbitrary SQL commands by supplying specially crafted input values th...

Sequelize: SQL Injection (Oracle DB)

Summary SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3. Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. javascript else if dialect === 'oracle...

NPM: Sequelize: SQL Injection (Oracle DB)

NPM: Sequelize: SQL Injection Oracle DB vulnerability discovered by ? in WordPress Npm sequelize versions 6.37.4...

EUVD-2026-52429

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. In the Oracle dialect, when val is a string and starts wit...

CVE-2026-69240 Sequelize: SQL Injection (Oracle DB)

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. In the Oracle dialect, when val is a string and starts wit...

CVE-2026-69240

Summary: CVE-2026-69240 affects Sequelize (Node.js ORM). Before 6.37.4, the Oracle dialect may be vulnerable to SQL injection when strings reach the escape path in sql-string.js: if a string value starts with TO_TIMESTAMP or TO_DATE, quotes are not escaped, returning the string unmodified. This a...

CVE-2026-52887

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filterlatestMsgReceiveTimestamp$lt value was inserted into a...

K000161154: Sequelize vulnerability CVE-2026-30951

Security Advisory Description Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An...

📄 Sequelize 6.37.7 SQL Injection

A remote SQL injection vulnerability exists Sequelize versions 6.37.7 and below in the JSON/JSONB where clause processing. When Sequelize parses a JSON path key containing ::, the value after :: is treated as a SQL cast type and is inserted into the generated SQL without proper validation. If an...

EUVD-2026-10870

Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type...

@142vip/egg (>=0.0.1-alpha.1 <=0.0.1-alpha.6), @142vip/egg-axios (>=0.0.1-alpha.1 <=0.0.1-alpha.2) +297 more potentially affected by CVE-2026-30951 via sequelize (>=6.0.0-beta.4 <=6.37.7)

sequelize NPM version =6.0.0-beta.4, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.1-alpha.2, =0.0.1-alpha.2, =0.0.1-alpha.2, =1.2.3, =1.0.0, =15.0.0, =1.0.0, =0.18.0, =5.0.0-alpha.3, =13.5.0, =1.0.70, =1.0.155 and more Source cves: CVE-2026-30951 Source advisory: OSV:GHSA-6457-6JRX-69CR...

Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

Summary SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data...

@142vip/egg (>=0.0.1-alpha.1 <=0.0.1-alpha.6), @142vip/egg-axios (>=0.0.1-alpha.1 <=0.0.1-alpha.2) +297 more potentially affected by CVE-2026-30951 via sequelize (>=6.0.0-beta.4 <=6.37.7)

sequelize NPM version =6.0.0-beta.4, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.1-alpha.2, =0.0.1-alpha.2, =0.0.1-alpha.2, =1.2.3, =1.0.0, =15.0.0, =1.0.0, =0.18.0, =5.0.0-alpha.3, =13.5.0, =1.0.70, =1.0.155 and more Source cves: CVE-2026-30951 Source advisory: SNYK:JS-SEQUELIZE-15456219...

EUVD-2026-10871

Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type...

SQL Injection

Overview sequelize is a promise-based Node.js ORM for Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server. Affected versions of this package are vulnerable to SQL Injection via the traverseJSON function, which escapes JSON path values but not cast types after the :: operator. An attacker ca...

GHSA-6457-6JRX-69CR Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

Summary SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data...

Linux Distros Unpatched Vulnerability : CVE-2026-30951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON functio...