CVE-2026-69240 in Sequelize
Summary
by MITRE • 08/04/2026
Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacker can inject arbitrary SQL expressions through an application value that reaches this escape path. This issue is fixed in version 6.37.4.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability affects Sequelize versions prior to 6.37.4 and represents a critical sql injection flaw specific to the oracle dialect implementation. The issue stems from improper escaping of string values within the sql-string.js file where the escape function fails to sanitize input when values begin with TO_TIMESTAMP or TO_DATE prefixes. This creates a direct pathway for attackers to inject malicious sql commands through applications that utilize the oracle dialect and pass user-controlled input through sequelize query methods.
The technical implementation flaw occurs in the escape function logic where string values starting with TO_TIMESTAMP or TO_DATE are returned unmodified instead of undergoing proper quote escaping. This behavior violates fundamental security principles of input sanitization and demonstrates a classic sql injection vulnerability pattern. When an application passes user-supplied data that matches this specific pattern to sequelize query builders, the raw input bypasses normal escaping mechanisms and gets directly incorporated into generated sql statements.
The operational impact of this vulnerability is significant within environments using oracle databases through sequelize, as it allows attackers to execute arbitrary sql commands with the privileges of the database user. This could lead to data exfiltration, unauthorized data modification, privilege escalation, or complete database compromise depending on the underlying database permissions and access controls. The vulnerability specifically targets applications that utilize the oracle dialect and do not properly validate input before passing it to sequelize query methods.
Security mitigations should focus on immediate version upgrades to 6.37.4 or later where the escaping logic has been corrected to properly handle TO_TIMESTAMP and TO_DATE prefixed strings. Organizations should also implement comprehensive input validation at application boundaries, employ parameterized queries wherever possible, and conduct thorough code reviews of sql generation logic. This vulnerability aligns with CWE-89 sql injection and ATT&CK technique T1071.004 application layer protocol exploitation, emphasizing the importance of proper input sanitization in orm tools that generate dynamic sql queries.
The fix implemented in version 6.37.4 addresses the root cause by ensuring all string values undergo proper escaping regardless of their prefix, preventing the bypass of quote escaping mechanisms. This remediation aligns with security best practices for preventing injection vulnerabilities in database abstraction layers and demonstrates the critical importance of thorough testing of edge cases in sql generation functions. Organizations should perform impact assessments to identify applications using vulnerable sequelize versions and ensure proper patching across all environments where oracle dialect is employed.