Loading vulnerability…
SQL Injection in Sequelize Oracle Date Function Handling
CVE-2026-69240 is an SQL injection vulnerability in Sequelize versions before 6.37.4 when configured with the Oracle dialect. The escape function returns string values beginning with TO_TIMESTAMP or TO_DATE directly rather than escaping single quotes. Attacker-controlled application values reaching this code path can therefore be interpreted as arbitrary SQL expressions instead of string data.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise database confidentiality and integrity through unauthorized data access and modification. Database availability may also be affected. The scope of impact depends on the surrounding query and the privileges of the application's database account.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by avoiding Oracle dialect deployments on affected Sequelize versions, preventing untrusted input from reaching query construction paths that invoke the vulnerable escape logic, and enforcing strict parameterization or bind-variable usage for all user-controlled values. Additional defensive measures include input validation that rejects or neutralizes unexpected Oracle expression-like strings and restricting database account privileges to limit post-exploitation impact.
Patch, then assume compromise.
Upgrade the sequelize npm package to version 6.37.4 or later. For Fedora-packaged sgx-pccs deployments, dependency updates addressing this CVE are included in sgx-pccs-1.27-2.fc43, sgx-pccs-1.27-2.fc44, and sgx-pccs-1.27-2.fc45. These Fedora updates were pending testing at the time of their notices; verify their current publication status before deployment.
No public exploits tracked yet. Mallory keeps watching.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.