Sequelize is a Node.js ORM used to interact with relational databases. In versions before 6.37.8, the internal _traverseJSON() function splits JSON path keys on the delimiter '::' to extract a presumed cast type. This type is then interpolated directly into a SQL CAST clause without escaping. An attacker who can control the keys of a JSON object supplied to the ORM can insert arbitrary SQL fragments, enabling execution of unintended statements and exfiltration of data from any table. The vulnerability is an instance of CWE‑89 as it involves unsanitized input used in SQL generation.

The affected product is Sequelize, the Node.js ORM, with all versions released prior to 6.37.8. This includes the open‑source Sequelize project managed by Sequelizejs:sequelize. Any deployment that relies on these versions for database interactions is at risk.

The CVSS base score of 7.5 indicates significant potential impact. The EPSS score is less than 1%, suggesting that exploitation is not common in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is application‑layer input manipulation: an attacker must supply crafted JSON keys that are processed by Sequelize’s where clause logic. Successful exploitation would give the attacker unauthorized database access and the ability to read or modify data, which could directly compromise confidentiality and integrity.