SQL injection in Sequelize ORM (Oracle dialect) (CVE-2026-69240)

Sequelize's escape function in sql-string.js fails to escape single quotes in string values that begin with TO_TIMESTAMP or TO_DATE when the Oracle dialect is in use, returning the raw value instead. This allows an unauthenticated remote attacker to inject arbitrary SQL expressions into queries, enabling data theft and tampering. Public POC available. Affected versions: - < 6.37.4 We recommend updating to: 6.37.4. CVSS 9.8 · our assessment: act_now Reference: https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452 Details: https://vuln.today/cve/CVE-2026-69240