Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-st…

A SQL injection vulnerability exists in Sequelize, a Node.js ORM tool, prior to version 6.37.4. The flaw is specific to the Oracle dialect and resides in the escape function within sql-string.js. When a string value begins with TO_TIMESTAMP or TO_DATE, the function returns the value directly without escaping single quotes, allowing arbitrary SQL expressions to be injected. An attacker who can control application input reaching this escape path can exploit the vulnerability to manipulate SQL queries. The issue has been patched in Sequelize version 6.37.4. Users of the Oracle dialect are advised to upgrade immediately. No workaround is described other than updating to the fixed version.