CVE-2026-30951: Sequelize SQL Injection via JSON Column Cast Type Vulnerability

Background

Sequelize is a promise-based Node.js ORM (Object-Relational Mapping) for various SQL databases. It provides an easy-to-use interface for interacting with databases, allowing developers to define models, perform queries, and manage relationships between data. The vulnerability in question affects versions 6.x through 6.37.7, where improper handling of JSON column cast types can lead to SQL injection attacks.

Vulnerability Detail

The vulnerability arises from the _traverseJSON() function in Sequelize's query generator, which fails to properly validate cast types extracted from JSON path keys. This oversight allows an attacker to inject arbitrary SQL through unescaped cast types in the where clause of queries involving JSON/JSONB columns. As a result, an attacker can exfiltrate sensitive data from any table in the database using techniques such as UNION-based or boolean-blind SQL injection. This vulnerability impacts all dialects that support JSON, including SQLite, PostgreSQL, MySQL, and MariaDB.

npm install sequelize@6.37.8

Workaround

As a temporary workaround, you can sanitize user inputs by validating JSON keys before passing them to the where clause. For example, you can implement a function to check if the cast type is in a predefined set of allowed types:

const ALLOWED_CAST_TYPES = new Set([
  'integer', 'text', 'real', 'numeric', 'boolean', 'date',
  'timestamp', 'timestamptz', 'json', 'jsonb', 'float',
  'double precision', 'bigint', 'smallint', 'varchar', 'char',
]);

function validateCastType(cast) {
  if (cast && !ALLOWED_CAST_TYPES.has(cast.toLowerCase())) {
    throw new Error(`Invalid cast type: ${cast}`);
  }
}

Conclusion

The CVE-2026-30951 vulnerability in Sequelize exposes applications to SQL injection attacks through improper handling of JSON column cast types. It is crucial to update to the patched version 6.37.8 or later and to implement input validation as a preventive measure.

See every vulnerability recorded for sequelize →

FAQ