{"uuid": "74d7cbd7-3889-4468-8e87-be7a6ecd862f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://gist.github.com/alon710/d6efe0abb614ef8ea563c1fdaaf1246b", "content": "# CVE-2026-69240: CVE-2026-69240: SQL Injection Vulnerability in Sequelize ORM Oracle Dialect\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69240\n\n## Summary\nA critical SQL injection vulnerability was discovered in Sequelize when configured to use the Oracle database dialect. Due to a flawed optimization design in the SQL escaping subsystem (src/sql-string.js), strings that begin with native Oracle date functions bypass standard escaping. This allows unauthenticated remote attackers to execute arbitrary SQL commands on the target database.\n\n## TL;DR\nSequelize versions prior to 6.37.4 fail to escape single quotes when string inputs start with TO_DATE or TO_TIMESTAMP, leading to critical SQL injection in applications using the Oracle dialect.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: None (UI:N)\n- **Impact**: Confidentiality, Integrity, Availability (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using Sequelize ORM with Oracle database backend\n- **sequelize**: < 6.37.4 (Fixed in: `6.37.4`)\n\n## Mitigation\n\n- Upgrade Sequelize to version 6.37.4 or later\n- Implement input sanitization rules to block TO_DATE and TO_TIMESTAMP prefixes\n- Use parameterized bind variables where possible to isolate data from commands\n\n**Remediation Steps:**\n1. Identify all service deployments using Sequelize with the Oracle database dialect.\n2. Update the package.json file to specify sequelize version ^6.37.4.\n3. Execute npm install or yarn install to apply the patch.\n4. Validate that all application tests pass and deploy the changes.\n\n## References\n\n- [GitHub Security Advisory GHSA-v8fg-2rw7-q452](https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452)\n- [Sequelize Release Note (v6.37.4)](https://github.com/sequelize/sequelize/releases/tag/v6.37.4)\n- [NVD CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69240)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69240) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T05:31:41.629580Z"}