PT-2026-67508 · Npm · Sequelize

CVE-2026-69240 · Published 2026-08-03 · Updated 2026-08-03

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sequelize versions prior to 6.37.4

Description SQL injection is possible when the dialect is set to oracle. The escape() function in sql-string.js fails to escape single quotes if the input string starts with TO TIMESTAMP or TO DATE, returning the value directly. This allows an attacker to inject arbitrary SQL expressions through application values that reach this execution path, potentially leading to data theft and tampering.

Recommendations Update to version 6.37.4.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-69240

GHSA-V8FG-2RW7-Q452

Affected Products

Sequelize

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-69240 · Security Note
• https://osv.dev/vulnerability/GHSA-v8fg-2rw7-q452 · Vendor Advisory
• https://github.com/sequelize/sequelize/commit/5deadd2410ae9136a21fb652db206d27bb715f26 · Note
• https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452 · Note
• https://github.com/sequelize/sequelize/releases/tag/v6.37.4 · Note
• https://github.com/sequelize/sequelize · Note