Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacker can inject arbitrary SQL expressions through an application value that reaches this escape path. This issue is fixed in version 6.37.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-69240: Sequelize Oracle SQL Injection Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04xWN1t0
Post summary
The post announces CVE‑2026‑69240 as a Sequelize Oracle SQL Injection flaw and links to further details, indicating a disclosure of technical information without mentioning patches, exploits, or active use.
🚨Critical - Sequelize Oracle Dialect SQL Injection via TO_DATE/TO_TIMESTAMP Escape Bypass (CVE-2026-69240) In Sequelize's Oracle dialect, the Oracle-specific string escaping logic returns values starting with TO_TIMESTAMP or TO_DATE without escaping quotes. Attacker-controlled input can inject arbitrary SQL expressions via crafted date/timestamp strings, leading to SQLi. Other dialects aren’t impacted. 👉Affected: sequelize < 6.37.4 | Upgrade to 6.37.4
Post summary
Sequelize’s Oracle dialect suffers a critical SQL injection (CVE‑2026‑69240) due to unescaped TO_DATE/TO_TIMESTAMP inputs; upgrading to version 6.37.4 resolves the vulnerability.