What is the CVSS score of EUVD-2026-52429?

EUVD-2026-52429 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Sequelize are affected by EUVD-2026-52429?

Sequelize Node.js ORM versions prior to 6.37.4 contain a critical SQL injection vulnerability specific to Oracle database deployments, enabling remote attackers to execute arbitrary database commands…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-52429?

Yes, a public proof-of-concept exploit is available for EUVD-2026-52429. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-52429?

Within 24 hours, inventory all applications using Sequelize with Oracle dialect by reviewing package.json files and database connection configurations across development, staging, and production environments. Within 7 days, implement compensating controls including strict input validation to reject or sanitize strings beginning with TO_TIMESTAMP or TO_DATE, deploy Web Application Firewall rules to detect SQL injection patterns, and evaluate migration to alternative Node.js ORMs if feasible. Within 30 days, establish continuous monitoring of the Sequelize npm package and security advisories for version 6.37.4 or later; prepare an emergency deployment procedure for all affected systems and conduct forensic review of Oracle database audit logs to detect exploitation attempts.

Sequelize EUVD-2026-52429

| CVE-2026-69240 CRITICAL

SQL Injection (CWE-89)

2026-08-03 GitHub_M

GHSA-v8fg-2rw7-q452

Node.js Oracle SQLi Sequelize Red Hat Suse

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote unauthenticated SQL injection via a user value reaching escape(); Oracle-dialect requirement is a deployment precondition, not attacker complexity, so AC:L with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.8 CRITICAL

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 03, 2026 - 21:17 EUVD

Source Code Evidence Fetched

Aug 03, 2026 - 21:05 vuln.today

Analysis Generated

Aug 03, 2026 - 21:05 vuln.today

CVE Published

Aug 03, 2026 - 20:28 cve.org

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 npm packages depend on sequelize (3 direct, 3 indirect)

Ecosystem-wide dependent count for version 6.37.4.

DescriptionCVE.org

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacker can inject arbitrary SQL expressions through an application value that reaches this escape path. This issue is fixed in version 6.37.4.

Articles & Coverage 1

News Critical SQL Injection in Sequelize ORM for Node.js (Oracle Dialect) - CVE-2026-69240 Aug 03, 2026

AnalysisAI

SQL injection in the Sequelize Node.js ORM (versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL through application values that reach the string-escaping routine, but only when the ORM is configured with the Oracle dialect. The escape() function in sql-string.js returns any string beginning with TO_TIMESTAMP or TO_DATE verbatim without doubling single quotes, letting a crafted value break out of the intended literal. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-v8fg-2rw7-q452); there is no CISA KEV listing and no EPSS score was provided.

Technical ContextAI

Sequelize is one of the most widely used promise-based ORMs for Node.js, mapping JavaScript queries to dialect-specific SQL. The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect in the Oracle dialect code path. When dialect === 'oracle' and the value is a string, escape() contains a special case: if the string starts with TO_TIMESTAMP or TO_DATE (Oracle date/timestamp conversion functions), it returns the value directly and skips the val.replace(/'/g, "''") quote-doubling that normally neutralizes embedded single quotes. This whitelist-by-prefix logic was presumably intended to let callers pass raw Oracle date-conversion expressions, but because it bypasses escaping entirely, an attacker who controls a value that begins with those tokens can append arbitrary SQL. The single affected package is npm/sequelize (cpe:2.3:a:sequelize:sequelize).

RemediationAI

Vendor-released patch: 6.37.4 - upgrade the sequelize npm package to 6.37.4 or later, which restores proper single-quote escaping in the Oracle dialect path (fix commit 5deadd2410ae9136a21fb652db206d27bb715f26). Because the vulnerability is confined to the Oracle dialect, any deployment not using dialect: 'oracle' is unaffected and can upgrade at normal cadence. Where an immediate upgrade is not possible on Oracle-backed apps, the actionable compensating controls are: use parameterized queries / bind parameters (replacements or bind arrays) instead of passing user input as raw values into where clauses so tainted strings never reach the vulnerable escape path; and add input validation to reject or neutralize application values that begin with TO_TIMESTAMP or TO_DATE before they are handed to Sequelize - the trade-off being that legitimate date-conversion expressions passed as literals would also be blocked. Advisory and patch references: https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452 and https://github.com/sequelize/sequelize/commit/5deadd2410ae9136a21fb652db206d27bb715f26.