Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

Vulnerability

Overview

CVE-2026-30951 is a SQL injection vulnerability in Sequelize, a Node.js ORM, affecting versions prior to 6.37.8. The flaw resides in the _traverseJSON() function within src/dialects/abstract/query-generator.js. When processing JSON/JSONB column queries, the function splits JSON path keys on :: to extract a cast type, which is then interpolated directly into a CAST(... AS ) SQL statement without any sanitization or validation [1][2].

Exploitation

An attacker who can control JSON object keys—for example, by providing user-supplied data that is stored in a JSON column and later used in a WHERE clause—can inject arbitrary SQL. The cast type portion of the key is not escaped, allowing the attacker to break out of the CAST expression and append malicious SQL. No special authentication is required beyond the ability to influence the JSON keys that are queried [2].

Impact

Successful exploitation enables an attacker to execute arbitrary SQL commands, potentially exfiltrating data from any table in the database. The vulnerability is rated with a CVSS score yet to be provided by NVD, but the advisory classifies it as high severity due to the ease of exploitation and the potential for data leakage [1][2].

Mitigation

The vulnerability is fixed in Sequelize version 6.37.8. Users should upgrade immediately. The v7 line (@sequelize/core) is not affected. No workarounds are documented; the recommended fix is to whitelist allowed SQL data types for cast operations [2].