Sequelize SQL Injection via Oracle Dialect Date/Timestamp Escaping (CVE-2026-69240)

What Happened

A GitHub Security Advisory (GHSA-v8fg-2rw7-q452) discloses a SQL injection vulnerability in sequelize, the popular Node.js ORM, tracked as CVE-2026-69240 with a CVSS score of 9.8. The flaw is confirmed on Sequelize v6.37.3 and affects applications using the oracle dialect only. According to the advisory, the escape function in sql-string.js skips quote-escaping for string values that start with TO_TIMESTAMP or TO_DATE. An attacker can craft an input like TO_DATE('0','Y')||'' OR 1=1-- to break out of the intended query context, as shown in the published proof-of-concept using a simple findOne lookup on user-controlled input.

Why It Matters

SQL injection with this severity can lead to unauthorized data access, data tampering, or full database compromise — the advisory cites "data theft and tampering" as the impact. Because the vulnerable path is any application code that passes user-controlled strings into a Sequelize where clause (a very common pattern), this could affect a meaningful number of Node.js applications that specifically configure Sequelize with the oracle dialect. Applications using other dialects (Postgres, MySQL, MSSQL, SQLite) do not appear to be affected based on the details provided.

What Defenders Should Do Now

• Identify whether any applications in your environment use Sequelize with dialect: 'oracle', and check the in-use Sequelize version against the fixed release once available.
• Review code paths where user-supplied input (query params, form fields) flows into Sequelize where clauses without additional validation.
• As a stopgap, consider input validation/allow-listing that rejects string values beginning with TO_TIMESTAMP or TO_DATE before they reach Sequelize on Oracle-backed deployments.
• Hunt for anomalous database query patterns or errors referencing TO_DATE/TO_TIMESTAMP combined with unexpected boolean or UNION-style clauses in application or database logs.
• Apply the patched Sequelize release as soon as it is confirmed and available, prioritizing any Oracle-backed, internet-facing services.

Developing Intel

This is a same-day advisory and details may evolve as the maintainers finalize a fix and disclosure timeline. Defenders using Sequelize with Oracle databases should treat this as high priority pending confirmation of a patched version. For full technical details, see the original advisory: GHSA-v8fg-2rw7-q452.