CVE-2026-30951: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30951 is a SQL injection vulnerability in Sequelize, a Node.js ORM tool, affecting all v6.x releases through 6.37.7. The flaw exists in JSON/JSONB where clause processing, where attacker-controlled JSON object keys can inject arbitrary SQL into generated CAST(... AS <type>) statements. It was published by GitHub Advisory (GHSA-6457-6jrx-69cr) on March 9, 2026, and registered in the NVD on March 10, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat Bugzilla). Sequelize v7 (@sequelize/core) is not affected.

The root cause (CWE-89) lies in the _traverseJSON() function in src/dialects/abstract/query-generator.js, which splits JSON path keys on :: to extract a cast type. This cast type is passed through _castKey() to Utils.Cast and then interpolated directly and without sanitization into the SQL string as CAST(${result} AS ${smth.type.toUpperCase()}). While JSON path values are properly escaped via this.escape(), the cast type extracted from the key is never validated or escaped. An attacker who controls JSON object keys in a Sequelize where clause — for example, via a user-supplied request body passed directly to findAll() — can inject arbitrary SQL, enabling WHERE clause bypass (role::text) or 1=1--) or UNION-based cross-table data exfiltration. All dialects supporting JSON are affected: SQLite, PostgreSQL, MySQL, and MariaDB (Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to exfiltrate data from any table in the underlying database via UNION-based or boolean-blind SQL injection. The primary impact is high confidentiality loss — sensitive data such as API keys, passwords, and user records can be extracted without any authentication or user interaction. Integrity and availability are not directly impacted by this vulnerability, but stolen credentials could enable further lateral movement or privilege escalation within the affected environment (Github Advisory, Red Hat Bugzilla).

A working proof-of-concept (PoC) JavaScript script is publicly available in the official Sequelize security advisory, demonstrating both WHERE clause bypass and UNION-based cross-table data exfiltration against a real SQLite in-memory database (Github Advisory). An additional PoC repository has been identified at https://github.com/EQSTLab/CVE-2026-30951, and the vulnerability has been indexed by Sploitus and exploit intelligence platforms. The EPSS score is approximately 0.035% (low probability of near-term exploitation), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. No specific threat actor attribution has been reported.

1. Identify vulnerable applications: Search for Node.js applications using Sequelize v6.0.0-beta.1 through 6.37.7 that expose API endpoints accepting user-controlled JSON objects as filter/search parameters (e.g., POST /api/users/search with req.body.filter passed directly to a findAll() where clause on a JSON/JSONB column).
2. Craft a malicious JSON key: Construct a JSON object where the key contains a :: separator followed by a SQL injection payload. The portion after :: is treated as the cast type and injected raw into the SQL query.
3. WHERE clause bypass (reconnaissance): Send a request with a payload such as { "metadata": { "role::text) or 1=1--": "anything" } }. This generates the SQL: WHERE CAST(json_extract(...,'$.role') AS TEXT) OR 1=1--) = 'anything', returning all rows.
4. UNION-based data exfiltration: Craft a key like role::text) and 0 union select id,key,value,null,null from Secrets-- to generate a UNION query that retrieves data from arbitrary tables. The resulting SQL: WHERE CAST(...AS TEXT) AND 0 UNION SELECT ID,KEY,VALUE,NULL,NULL FROM SECRETS--) = 'x'.
5. Extract sensitive data: Parse the API response, which will contain rows from the injected UNION query (e.g., API keys, passwords) mapped to the original model's column names (Github Advisory).

• Network: Unusual HTTP POST requests to search/filter API endpoints with JSON bodies containing :: in object keys, especially keys with SQL keywords such as or, union, select, from, --.
• Logs: Application or database query logs showing malformed CAST(... AS ...) SQL statements with injected clauses; queries containing UNION SELECT or OR 1=1 patterns originating from ORM-generated SQL.
• Application Behavior: API responses returning unexpected numbers of records (e.g., all rows when a filtered result is expected) or data from unrelated database tables mapped to model fields.
• Database Audit Logs: Queries accessing tables not normally queried by the application (e.g., secrets, credentials, or configuration tables) via UNION-based injection (Github Advisory).

Upgrade Sequelize to version 6.37.8 or later, which fixes the vulnerability by whitelisting known SQL data types for cast values and rejecting any unrecognized cast type with an error (Github Advisory). If immediate patching is not possible, implement server-side input validation to reject JSON object keys containing :: or SQL metacharacters before passing them to Sequelize queries. Applications should never pass raw user-controlled objects directly as Sequelize where clause values for JSON/JSONB columns. IBM products including watsonx Orchestrate, QRadar Suite, Business Automation Insights, and Security QRadar EDR that bundle Sequelize v6 should apply the respective IBM security bulletins (IBM watsonx Advisory, IBM QRadar Advisory).

Red Hat tracked the vulnerability via Bugzilla (Bug 2446250) and classified it as high severity, with a Red Hat Security Errata (RHSA-2026:8498) subsequently issued. IBM published multiple security bulletins addressing the impact on downstream products including watsonx Orchestrate, QRadar Suite Software, Business Automation Insights, and Security QRadar EDR. The vulnerability was credited to researcher EthanKim88 and published through GitHub's coordinated disclosure process (Github Advisory, Red Hat Bugzilla).