Sequelize vulnerabilities
We track 3 vulnerabilities in Sequelize products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 3, 2026.
Latest Sequelize vulnerabilities
- 9.8 Critical severity
sequelize: Improper Neutralization of Special Elements used in an SQL Command
Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle diale
- 7.5 High severity
sequelize: Improper Neutralization of Special Elements used in an SQL Command
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS
- 9.8 Critical severity
sequelize: Improper Neutralization of Special Elements used in an SQL Command
Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific q