Sequelize vulnerabilities
3 known CVE vulnerabilities in Sequelize, translated and rated.
- CVE-2015-1369High
SQL injection vulnerability in Sequelize before version 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.
- CVE-2026-69240Critical
Sequelize, a Node.js ORM tool, is vulnerable to SQL injection in the Oracle dialect. The escape function fails to escape quotes when the value starts with TO_TIMESTAMP or TO_DATE, allowing arbitrary SQL injection.
- CVE-2026-30951High
Sequelize before version 6.37.8 contains an SQL injection vulnerability via unescaped cast type in JSON/JSONB WHERE clause processing. The _traverseJSON() function splits JSON path keys on '::' to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table.