7.5
Élevée
CVE-2026-30951 Sequelize is a Node.js ORM tool
Description
Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table. This vulnerability is fixed in 6.37.8.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Satellite 6.18 1776194798 | premières → < 1776194798 | 1776194798 |
| Confidential Compute Attestation | Versions non publiées | |
| Red Hat Enterprise Linux 10 | Versions non publiées | |
| Red Hat Enterprise Linux 9 | Versions non publiées | |
| sequelize 6.0 | 6.0.0-beta.1 → < 6.37.8 | 6.37.8 |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Satellite 6.18
Les 43 CVE de Red Hat Satellite 6.18 →
CVE-2026-13676
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs
7.5
Élevée
CVE-2026-9073
A flaw was found in foreman-mcp-server
6.2
Moyenne
CVE-2026-12112
A flaw was found in the foreman-mcp-server
7.8
Élevée
CVE-2026-44990
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer…
9.3
Critique