Sequelize CVE-2026-69240

Exploitation requires that Sequelize be configured with the Oracle dialect (dialect: 'oracle') - the flaw does not exist for any other dialect. In addition, an attacker-controlled application value must reach the sql-string.js escape() path (for example, user input passed directly as a value in a where clause) and must begin with the literal prefix TO_TIMESTAMP or TO_DATE so that the quote-doubling is skipped; the payload then uses Oracle string concatenation/comment syntax to break out. Limiting factors: the Oracle-dialect requirement makes this a non-default configuration for most Sequelize users; the value must be routed through the vulnerable escape function rather than through bind parameters; and the affected versions are all releases before 6.37.4. No user interaction or authentication is required per the CVSS vector (PR:N/UI:N) once the app exposes such a value.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) treats this as network-reachable, unauthenticated, low-complexity full-impact SQL injection, which is defensible for the classic SQLi pattern. However, that raw score understates a major real-world limiter: exploitation is only possible when Sequelize is configured with the Oracle dialect, which is a comparatively uncommon deployment among Sequelize users (Postgres/MySQL/MariaDB/SQLite/MSSQL are far more typical). The attacker must also control a value that both begins with TO_TIMESTAMP or TO_DATE and reaches this escape path, so the effective attack surface is narrower than a generic 9.8 implies. No EPSS score and no KEV status were supplied; a working PoC is published in the advisory, so this is 'publicly available exploit code exists' rather than confirmed active exploitation. Net assessment: genuinely high severity for Oracle-dialect deployments and worth prompt patching there, but for the majority of Sequelize installs (non-Oracle dialects) the practical risk is effectively nil. The Oracle-only precondition should be the primary triage input, not the headline CVSS number.

An application backed by Oracle uses Sequelize and passes a request parameter directly into a where clause, e.g. Student.findOne({ where: { firstName: req.query.firstName } }). An attacker sends firstName=TO_DATE('0','Y')||'' OR 1=1-- , which the escape function returns unescaped because it starts with TO_DATE, producing a WHERE clause with an attacker-controlled OR 1=1-- and enabling data theft or tampering. A working PoC is published in the GitHub advisory.