{"vulnerability": "cve-2026-69240", "sightings": [{"uuid": "74d7cbd7-3889-4468-8e87-be7a6ecd862f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://gist.github.com/alon710/d6efe0abb614ef8ea563c1fdaaf1246b", "content": "# CVE-2026-69240: CVE-2026-69240: SQL Injection Vulnerability in Sequelize ORM Oracle Dialect\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69240\n\n## Summary\nA critical SQL injection vulnerability was discovered in Sequelize when configured to use the Oracle database dialect. Due to a flawed optimization design in the SQL escaping subsystem (src/sql-string.js), strings that begin with native Oracle date functions bypass standard escaping. This allows unauthenticated remote attackers to execute arbitrary SQL commands on the target database.\n\n## TL;DR\nSequelize versions prior to 6.37.4 fail to escape single quotes when string inputs start with TO_DATE or TO_TIMESTAMP, leading to critical SQL injection in applications using the Oracle dialect.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: None (UI:N)\n- **Impact**: Confidentiality, Integrity, Availability (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using Sequelize ORM with Oracle database backend\n- **sequelize**: < 6.37.4 (Fixed in: `6.37.4`)\n\n## Mitigation\n\n- Upgrade Sequelize to version 6.37.4 or later\n- Implement input sanitization rules to block TO_DATE and TO_TIMESTAMP prefixes\n- Use parameterized bind variables where possible to isolate data from commands\n\n**Remediation Steps:**\n1. Identify all service deployments using Sequelize with the Oracle database dialect.\n2. Update the package.json file to specify sequelize version ^6.37.4.\n3. Execute npm install or yarn install to apply the patch.\n4. Validate that all application tests pass and deploy the changes.\n\n## References\n\n- [GitHub Security Advisory GHSA-v8fg-2rw7-q452](https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452)\n- [Sequelize Release Note (v6.37.4)](https://github.com/sequelize/sequelize/releases/tag/v6.37.4)\n- [NVD CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69240)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69240) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T05:31:41.629580Z"}, {"uuid": "c9059df3-5425-4567-be08-4199ff9dca08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms7fkh4ivf2h", "content": "CVE-2026-69240 - sequelize\nSequelize, a database library, has a vulnerability that allows attackers to inject malicious SQL code when using the Oracle dialect. This can lead to data theft and tampering. To fix\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sequelize #npm #CVE #infosec", "creation_timestamp": "2026-08-03T21:04:04.896099Z"}, {"uuid": "1b133c9f-37c7-415d-bfc3-9662e5baf38f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7iowh6z32g", "content": "\ud83d\udd34 CVE-2026-69240 - Critical (9.8)\n\nSequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-69240/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-03T22:00:16.757740Z"}, {"uuid": "7cdee7c6-5443-4c46-9cc7-57ba646a8b26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69240", "type": "published-proof-of-concept", "source": "https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452", "content": "", "creation_timestamp": "2026-08-03T22:35:08.866721Z"}]}