SQL Injection Vulnerability in Sequelize ORM for Oracle Dialect
CVE-2026-69240

9.8CRITICAL

Key Information:

Vendor

Sequelize

Status
Sequelize
Vendor
CVE Published:
3 August 2026

What is CVE-2026-69240?

The Sequelize ORM, a popular tool for Node.js, has a vulnerability that allows SQL injection when used with the Oracle dialect. Before version 6.37.4, the escape function in sql-string.js failed to properly handle input values starting with TO_TIMESTAMP or TO_DATE, returning them directly without escaping quotes. This oversight can be exploited by attackers to inject malicious SQL expressions into the application, potentially compromising the database's integrity. Users are strongly encouraged to upgrade to version 6.37.4 or later to mitigate this risk.

Affected Version(s)

sequelize < 6.37.4

References

https://github.com/sequelize/sequelize/security/advisorie...
x_refsource_CONFIRM
https://github.com/sequelize/sequelize/commit/5deadd2410a...
x_refsource_MISC
https://github.com/sequelize/sequelize/releases/tag/v6.37.4
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.