494 matches found
CVE-2026-30951
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An attacker who controls JSON object...
CVE-2026-30951
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An attacker who controls JSON object...
CVE-2026-30951 Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An attacker who controls JSON object...
CVE-2026-30951 Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An attacker who controls JSON object...
CVE-2026-30951
CVE-2026-30951 affects Sequelize (Node.js ORM). Prior to version 6.37.8, JSON/JSONB where-clause processing can interpolate an unescaped cast type via _traverseJSON(), inserting CAST(... AS ) with attacker-controlled JSON keys, enabling arbitrary SQL and data exfiltration from any table. The vuln...
CVE-2026-30951 Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An attacker who controls JSON object...
CVE-2026-30951: Improper Neutralization of Special Elements used in an SQL Command
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An attacker who controls JSON object...
PT-2026-24433
Name of the Vulnerable Software and Affected Versions Sequelize versions prior to 6.37.8 Description Sequelize, a Node.js ORM tool, contains a SQL injection flaw due to unescaped cast type handling within JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys using ':...
Sequelize SQL注入漏洞
Sequelize is an open-source database ORM Object-Relational Mapping tool for Node.js. Versions of Sequelize prior to 6.37.8 had a SQL injection vulnerability. This vulnerability stemmed from type conversion that wasn’t properly escaped during the handling of JSON/JSONB WHERE clauses, which could...
CVE-2019-11069
Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used...
CVE-2023-25813
Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific queries in use. The issue has been fix...
EUVD-2025-176433
Malicious code in sequelize-configstore-neuromorphic-petrology npm...
EUVD-2025-175463
Malicious code in xo-sequelize-thermochronology-resonance npm...
EUVD-2025-177455
Malicious code in on-planckscale-sequelize-comet npm...
EUVD-2025-175592
Malicious code in webdriverio-umbriel-sequelize-version npm...
EUVD-2025-176430
Malicious code in sequelize-ophiuchus-parcel-procyon npm...
EUVD-2025-176432
Malicious code in sequelize-eris-europa-sails npm...
EUVD-2025-179230
Malicious code in dynamo-ganymede-init-sequelize npm...