CVE-2026-30951: Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

March 11, 2026

SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table.

Affected: v6.x through 6.37.7. v7 (@sequelize/core) is not affected.

References

github.com/advisories/GHSA-6457-6jrx-69cr
github.com/sequelize/sequelize
github.com/sequelize/sequelize/security/advisories/GHSA-6457-6jrx-69cr
nvd.nist.gov/vuln/detail/CVE-2026-30951

Code Behaviors & Features

Detect and mitigate CVE-2026-30951 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →