Critical SQL Injection in Sequelize Oracle Dialect Enables Remote Database Compromise
Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 4, 2026
A critical SQL injection flaw tracked as CVE-2026-69240 affects Sequelize when used with the Oracle database dialect, exposing applications that run versions prior to 6.37.4. The vulnerability lies in the ORM's sql-string.js escape logic, which fails to properly escape quotes when a supplied string begins with Oracle function names such as TO_DATE or TO_TIMESTAMP, causing attacker-controlled input to be inserted directly into generated SQL queries.
The issue is rated CVSS 9.8 and can be exploited remotely without authentication, potentially allowing attackers to bypass application controls, read sensitive data, alter or delete records, and execute arbitrary SQL expressions. Reports warn that in Oracle deployments with elevated database privileges, the impact could extend beyond the database to filesystem access or operating system command execution, creating a path to full host compromise. The vendor has released a fix in Sequelize 6.37.4 and advises affected users to upgrade immediately.
