TL;DR: Sequelize, the most popular Node.js ORM with 2.8 million weekly npm downloads, has a SQL injection vulnerability in its Oracle dialect. When a string value starts with TO_TIMESTAMP or TO_DATE, the escape function returns the value without sanitizing single quotes. An attacker can inject arbitrary SQL expressions through any application input that reaches this path. CVSS 9.8. Fixed in Sequelize 6.37.4.

What is Sequelize

Sequelize is a promise-based Node.js ORM that supports Postgres, MySQL, MariaDB, SQLite, DB2, Microsoft SQL Server, Snowflake, and Oracle. It handles schema modeling, migrations, transactions, eager and lazy loading, and read replication. At 2.8 million weekly npm downloads and 30,374 GitHub stars, it is the most popular relational database ORM in the Node.js ecosystem. Over 7,000 packages depend on it directly, including frameworks like Sails.js and Feathers.

That reach means a SQL injection in Sequelize is not a niche library vulnerability. It is a vulnerability that touches a large slice of the Node.js server-side landscape. Applications that use Sequelize with Oracle typically have strong business reasons for that database choice (enterprise ERP systems, financial platforms, legacy Oracle deployments), which means the data behind these applications tends to be high-value.

How big is the impact

The CVSS 9.8 score reflects the worst-case scenario: network-accessible, no authentication required, no user interaction needed, and full compromise of confidentiality, integrity, and availability. In practice, the Oracle dialect constraint limits the blast radius significantly. Sequelize defaults to Postgres, and the Oracle dialect requires an explicit configuration. Most Sequelize users are unaffected.

However, for the subset of applications using Sequelize with Oracle, the impact is severe. SQL injection through an ORM is particularly dangerous because developers trust the ORM to handle escaping. They pass user input to model queries without the same scrutiny they would apply to raw SQL. An attacker who identifies a vulnerable endpoint can read, modify, or delete any table the application user has access to. The fix, in version 6.37.4, ensures that the escape function in sql-string.js properly escapes single quotes regardless of the TO_TIMESTAMP or TO_DATE prefix.

What happened

The vulnerability lives in sql-string.js, the internal module that escapes string values before they are interpolated into SQL queries. For the Oracle dialect specifically, the escape function checks whether a string value starts with TO_TIMESTAMP or TO_DATE. If it does, the function returns the value as-is, without replacing single quotes. The reasoning was that these are Oracle function calls and should not be escaped. But an attacker-controlled string that starts with TO_TIMESTAMP and embeds a quote-termination followed by additional SQL passes through unmodified.

The fix, committed in 5deadd2, removes the TO_TIMESTAMP/TO_DATE bypass entirely and ensures that all string values in the Oracle dialect go through proper quote escaping.

What to do

Update Sequelize to version 6.37.4:

npm install [email protected]

If you use Sequelize with the Oracle dialect, audit your application logs for any unusual SQL patterns or unexpected query errors that might indicate exploitation attempts. If you do not use the Oracle dialect, you are not vulnerable to this specific issue, but updating is still recommended.

• GitHub Security Advisory
• Sequelize 6.37.4 Release Notes
• Sequelize on npm