GHSA-6457-6jrx-69cr — Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

Affected: npm: sequelize

### Summary

SQL injection via unescaped cast type in JSON/JSONB `where` clause processing. The `_traverseJSON()` function splits JSON path keys on `::` to extract a cast type, which is interpolated raw into `CAST(... AS <type>)` SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table.

Affected: v6.x through 6.37.7. v7 (`@sequelize/core`) is not affected.

### Details

In `src/dialects/abstract/query-generator.js`, `_traverseJSON()` extracts a cast type from `::` in JSON keys without validation:

```javascript // line 1892 _traverseJSON(items, baseKey, prop, item, path) { let cast; if (path[path.length - 1].includes("::")) { const tmp = path[path.length - 1].split("::"); cast = tmp[1]; // attacker-controlled, no escaping path[path.length - 1] = tmp[0]; } // ... items.push(this.whereItemQuery(this._castKey(pathKey, item, cast), { [Op.eq]: item })); } ```

`_castKey()` (line 1925) passes it to `Utils.Cast`, and `handleSequelizeMethod()` (line 1692) interpolates it directly:

```javascript return `CAST(${result} AS ${smth.type.toUpperCase()})`; ```

JSON path **values** are escaped via `this.escape()` in `jsonPathExtractionQuery()`, but the cast **type** is not.

**Suggested fix** — whitelist known SQL data types:

```javascript const ALLOWED_CAST_TYPES = new Set([ 'integer', 'text', 'real', 'numeric', 'boolean', 'date', 'timestamp', 'timestamptz', 'json', 'jsonb', 'float', 'do…

Most recent entries from all

GHSA-6457-6jrx-69cr — Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type