What is the CVSS score of CVE-2026-30951?

CVE-2026-30951 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-30951?

Yes, a public proof-of-concept exploit is available for CVE-2026-30951. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30951?

Within 24 hours: Identify all Node.js applications using Sequelize and document version numbers; assess whether JSON/JSONB filtering is used in production queries. Within 7 days: Implement input validation and parameterized query patterns to avoid dynamic JSON casting; deploy WAF rules to detect SQL injection patterns in application traffic; segment database access with least-privilege credentials. Within 30 days: Upgrade to Sequelize 6.37.8 or later when available; conduct code audit of all JSON/JSONB where clause implementations; perform penetration testing on affected query paths.

Sequelize CVE-2026-30951

HIGH

SQL Injection (CWE-89)

2026-03-10 security-advisories@github.com

GHSA-6457-6jrx-69cr

SQLi Node.js Sequelize Sequelizejs

7.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Control JSON object keys in query
Delivery

Inject cast type via :: separator
Exploit

Interpolate malicious SQL into CAST clause
Execution

Execute arbitrary SQL queries
Impact

Exfiltrate sensitive data

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Application uses Sequelize < 6.37.8 with JSON/JSONB WHERE clause filtering that processes attacker-controlled JSON object keys through _traverseJSON() function without cast type validation.
Impact	CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None.
Exploit ScenarioDerived	An attacker could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

SQL injection in Sequelize prior to version 6.37.8 allows unauthenticated attackers to execute arbitrary SQL queries and extract sensitive data by manipulating JSON object keys in WHERE clause operations. The vulnerability stems from improper sanitization of cast type parameters in the _traverseJSON() function, which directly interpolates user-controlled input into CAST SQL statements. Node.js applications using affected Sequelize versions are at risk of complete database compromise.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 7.5

Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. [CVSS 7.5 HIGH]

RemediationAI

Fixed in version 6.37.8.. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

Affected Packages

npm sequelize fix: 6.37.8

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Classified as CWE-89 (SQL Injection). Affects Sequelize is a Node.js ORM tool.. Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.

Know when Sequelize gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Red Hat 7.5 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 10, 2026 - 21:16 nvd

HIGH 7.5

DescriptionNVD

Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.

Executive ViewAI

Why It Matters

Applications using Sequelize ORM versions prior to 6.37.8 are vulnerable to SQL injection attacks through improperly escaped JSON/JSONB filtering, potentially allowing attackers to access, modify, or delete sensitive database records. Organizations running affected Node.js applications must assess exposure immediately, as no vendor patch is currently available and exploitation requires no special privileges.

Business Impact: High

Compensating Controls

Implement Web Application Firewall (WAF) rules to detect and block SQL injection payloads in request parameters; restrict database user permissions to read-only or stored procedure execution only; disable or restrict JSON/JSONB query functionality where not business-critical; implement database activity monitoring (DAM) to detect anomalous query patterns; apply strict input validation and type checking at application layer; consider network segmentation to limit database accessibility; enforce prepared statements and parameterized queries in application code review process.

Threat Intelligence Overview

EPSS Score

0.0%

Top 90% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

NVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.