Critical SQL Injection Vulnerability in Sequelize ORM Affects Oracle Users

CVE-2026-69240 is a critical SQL injection vulnerability affecting Sequelize ORM when configured for Oracle databases. The flaw, rated 9.8 on the CVSS scale, allows attackers to inject arbitrary SQL expressions through specially crafted input starting with 'TO_TIMESTAMP' or 'TO_DATE'. The escape function in sql-string.js fails to properly escape quotes in these cases, enabling potential exploitation. The vulnerability has been addressed in version 6.37.4, which users are urged to upgrade to immediately. No public proof-of-concept exploits have been reported, and there are no confirmed cases of exploitation in the wild. The vulnerability was first published on August 3, 2026, and has significant implications for affected users. Security advisories have been released, emphasizing the urgency of the situation.

Key Points: • CVE-2026-69240 is a critical SQL injection vulnerability rated 9.8 on CVSS. • The flaw affects Sequelize ORM when configured for Oracle databases, allowing SQL injection. • Users are urged to upgrade to version 6.37.4 to mitigate the risk of exploitation.