# Sequelize NoSQL injection

Source: https://junglewise.ai/threats/sequelize-nosql-injection-d79e4c1b  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-06-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2019-06-04

Sequelize is a popular ORM (object-relational mapping) library for Node.js that allows developers to interact with databases using JavaScript. Versions before 4.12.0 fail to properly sanitize query operators like $gt, allowing attackers to inject malicious NoSQL commands that can alter data queries, modify data, or potentially gain unauthorized access to the database.

Technologies: [sequelize (npm)](https://junglewise.ai/threats/technologies/sequelize). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 4 June 2019.

**Which products and versions are affected?** sequelize (npm) SEMVER:introduced=0,fixed=4.12.0.

**Is there a fix for This vulnerability?** Yes. sequelize (npm): upgrade to 4.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run sequelize (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sequelize (npm): upgrade to 4.12.0 or later

  ```sh
  npm install sequelize@4.12.0
  ```


## Technical details

Sequelize prior to version 4.12.0 is vulnerable to NoSQL Injection due to improper sanitization of query operators such as $gt. The vulnerability exists because query operators are not properly validated before being passed to the database engine, allowing an attacker to inject NoSQL operators into queries through application input. An attacker can craft special input that bypasses query filters and alters the intended database operation, leading to unauthorized data access or modification. The fix was implemented in version 4.12.0 and merged in pull request #8240, which adds proper operator sanitization.

## Affected products

- Sequelize Sequelize before 4.12.0

## Timeline

- 2019-06-04: disclosed
- 2017-09-30: patched: Fix merged in PR #8240

## References

- [https://github.com/sequelize/sequelize/issues/7310](https://github.com/sequelize/sequelize/issues/7310)
- [https://github.com/sequelize/sequelize/pull/8240](https://github.com/sequelize/sequelize/pull/8240)

## Related threats

- [Sequelize SQL injection in Oracle dialect escape function](https://junglewise.ai/threats/cve-2026-69240-sequelize-sql-injection-in-oracle-dialect-escape-function)
- [Sequelize SQL injection in JSON where clause processing](https://junglewise.ai/threats/cve-2026-30951-sequelize-sql-injection-in-json-where-clause-processing)
- [Sequelize SQL injection via unescaped parentheses in attributes](https://junglewise.ai/threats/cve-2023-22578-sequelize-sql-injection-via-unescaped-parentheses-in-attributes)
- [Sequelize unsafe fall-through in getWhereConditions](https://junglewise.ai/threats/cve-2023-22579-sequelize-unsafe-fall-through-in-getwhereconditions)
- [Sequelize SQL injection via replacements](https://junglewise.ai/threats/cve-2023-25813-sequelize-sql-injection-via-replacements)