CVE-2026-69240

Published: Aug 3, 2026Modified: Sep 10, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacker can inject arbitrary SQL expressions through an application value that reaches this escape path. This issue is fixed in version 6.37.4.

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (4)

https://github.com/sequelize/sequelize/commit/5deadd2410ae9136a21fb652db206d27bb715f26

Source: security-advisories@github.com

https://github.com/sequelize/sequelize/releases/tag/v6.37.4

Source: security-advisories@github.com

https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452

Source: security-advisories@github.com

https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.