CVE-2026-69240 AKAOMA CVE VULNERABILITIES / 1h Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacker can inject arbitrary SQL expressions through an app

Back cve.akaoma.com

CVE-2026-69240 AKAOMA CVE VULNERABILITIES / 1h Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacker can inject arbitrary SQL expressions through an app

cve.akaoma.com • August 4, 2026

Share: View original

9.8 /10 Critical Risk As a catastrophic security flaw, CVE-2026-69240 has severe implications, demanding immediate intervention.

As a catastrophic security flaw, CVE-2026-69240 has severe implications, demanding immediate intervention.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in Sequelize ORM Affects Oracle Users CVE-2026-69240 is a critical SQL injection vulnerability affecting Sequelize ORM when configured for Oracle databases. The flaw, rated 9.8 on the CVSS scale, allows attackers to inject arbitrary SQL expressions through specially crafted input starting with 'TO_TIMESTAMP' or 'TO_DATE'. The escape function in sql-string.js fails to properly escape quotes in these cases, enabling potential exploitation. The vulnerability has been addressed in version 6.37.4, which users are urged to upgrade to immediately. No public proof-of-concept exploits have been reported, and there are no confirmed cases of exploitation in the wild. The vulnerability was first published on August 3, 2026, and has significant implications for affected users. Security advisories have been released, emphasizing the urgency of the situation. 2 sources 73

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

Cwe-89 - SQL Injection

MITRE ATT&CK (1)

T1190 - Exploit Public-Facing Application

Tools (1)