CVE-2026-69240: Sequelize SQL Injection Vulnerability in Oracle DB

Background

Sequelize is a promise-based Node.js ORM (Object-Relational Mapping) that supports various SQL dialects, including PostgreSQL, MySQL, MariaDB, SQLite, and Oracle. It allows developers to interact with databases using JavaScript objects instead of SQL queries, simplifying database operations. However, a critical SQL injection vulnerability has been identified in the Oracle DB dialect, which can lead to unauthorized data access and manipulation.

Vulnerability Detail

The vulnerability arises from the escape function in sql-string.js, which fails to properly escape quotes in strings that start with TO_TIMESTAMP or TO_DATE when the dialect is set to 'oracle'. This oversight allows attackers to inject arbitrary SQL expressions into queries, potentially leading to data theft and tampering. For instance, an attacker can manipulate the firstName parameter in a query to execute malicious SQL code, compromising the integrity and confidentiality of the database.

npm install sequelize@6.37.8

npm install sequelize@6.37.4

Workaround

As a temporary workaround, avoid using user input directly in queries. Instead, use parameterized queries or prepared statements to ensure that user input is treated as data rather than executable code. For example, modify the code as follows:

var result = await models.Student.findOne({
  where: {
    firstName: {
      [Op.eq]: req.query.firstName
    }
  }
});

This approach helps prevent SQL injection by ensuring that user input is safely handled.

Conclusion

The SQL injection vulnerability in Sequelize when using Oracle DB is a critical issue that requires immediate attention. By updating to the patched version and implementing secure coding practices, developers can protect their applications from potential attacks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.

See every vulnerability recorded for sequelize →

FAQ