Vulnerability · Published Aug 3, 2026 · Assigned by GitHub_M

CVE-2026-69240Sequelize: SQL Injection (Oracle DB)

Critical 9.8

In plain English

A critical-severity SQL injection in sequelize from sequelize. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 54.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacker can inject arbitrary SQL expressions through an application value that reaches this escape path. This issue is fixed in version 6.37.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	sequelize	6.37.4	GHSA-v8fg-2rw7-q452

Affected products (as reported)

Vendor	Product	Versions
sequelize	sequelize	< 6.37.4

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452 x_refsource_CONFIRM
https://github.com/sequelize/sequelize/commit/5deadd2410ae9136a21fb652db206d27bb715f26 x_refsource_MISC
https://github.com/sequelize/sequelize/releases/tag/v6.37.4 x_refsource_MISC