CVE-2026-69240: SQL Injection Vulnerability in Sequelize ORM Oracle Dialect
Vulnerability ID: CVE-2026-69240
CVSS Score: 9.8
Published: 2026-08-03
A critical SQL injection vulnerability was discovered in Sequelize when configured to use the Oracle database dialect. Due to a flawed optimization design in the SQL escaping subsystem (src/sql-string.js), strings that begin with native Oracle date functions bypass standard escaping. This allows unauthenticated remote attackers to execute arbitrary SQL commands on the target database.
TL;DR
Sequelize versions prior to 6.37.4 fail to escape single quotes when string inputs start with TO_DATE or TO_TIMESTAMP, leading to critical SQL injection in applications using the Oracle dialect.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-89
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L)
- Privileges Required: None (PR:N)
- User Interaction: None (UI:N)
- Impact: Confidentiality, Integrity, Availability (High)
- Exploit Status: Proof of Concept (PoC) available
- KEV Status: Not listed
Affected Systems
- Node.js applications using Sequelize ORM with Oracle database backend
-
sequelize: < 6.37.4 (Fixed in:
6.37.4)
Code Analysis
Commit: 5deadd2
Fix SQL injection in Oracle dialect by replacing startsWith check with robust parsing and validation using moment.js
Mitigation Strategies
- Upgrade Sequelize to version 6.37.4 or later
- Implement input sanitization rules to block TO_DATE and TO_TIMESTAMP prefixes
- Use parameterized bind variables where possible to isolate data from commands
Remediation Steps:
- Identify all service deployments using Sequelize with the Oracle database dialect.
- Update the package.json file to specify sequelize version ^6.37.4.
- Execute npm install or yarn install to apply the patch.
- Validate that all application tests pass and deploy the changes.
References
Read the full report for CVE-2026-69240 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)