7.5
High
CVE-2026-30951 Sequelize is a Node.js ORM tool
Description
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Satellite 6.18 1776194798 | earliest → < 1776194798 | 1776194798 |
| Confidential Compute Attestation | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| sequelize 6.0 | 6.0.0-beta.1 → < 6.37.8 | 6.37.8 |
Other CVEs of Red Hat Satellite 6.18
The 43 CVEs of Red Hat Satellite 6.18 →
CVE-2026-13676
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs
7.5
High
CVE-2026-9073
A flaw was found in foreman-mcp-server
6.2
Medium
CVE-2026-12112
A flaw was found in the foreman-mcp-server
7.8
High
CVE-2026-44990
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer…
9.3
Critical