https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 04 Aug 2026 23:42:29 +0000 https://vulnerability.circl.lu/sighting/74d7cbd7-3889-4468-8e87-be7a6ecd862f/export {"uuid": "74d7cbd7-3889-4468-8e87-be7a6ecd862f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://gist.github.com/alon710/d6efe0abb614ef8ea563c1fdaaf1246b", "content": "# CVE-2026-69240: CVE-2026-69240: SQL Injection Vulnerability in Sequelize ORM Oracle Dialect\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69240\n\n## Summary\nA critical SQL injection vulnerability was discovered in Sequelize when configured to use the Oracle database dialect. Due to a flawed optimization design in the SQL escaping subsystem (src/sql-string.js), strings that begin with native Oracle date functions bypass standard escaping. This allows unauthenticated remote attackers to execute arbitrary SQL commands on the target database.\n\n## TL;DR\nSequelize versions prior to 6.37.4 fail to escape single quotes when string inputs start with TO_DATE or TO_TIMESTAMP, leading to critical SQL injection in applications using the Oracle dialect.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: None (UI:N)\n- **Impact**: Confidentiality, Integrity, Availability (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using Sequelize ORM with Oracle database backend\n- **sequelize**: < 6.37.4 (Fixed in: `6.37.4`)\n\n## Mitigation\n\n- Upgrade Sequelize to version 6.37.4 or later\n- Implement input sanitization rules to block TO_DATE and TO_TIMESTAMP prefixes\n- Use parameterized bind variables where possible to isolate data from commands\n\n**Remediation Steps:**\n1. Identify all service deployments using Sequelize with the Oracle database dialect.\n2. Update the package.json file to specify sequelize version ^6.37.4.\n3. Execute npm install or yarn install to apply the patch.\n4. Validate that all application tests pass and deploy the changes.\n\n## References\n\n- [GitHub Security Advisory GHSA-v8fg-2rw7-q452](https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452)\n- [Sequelize Release Note (v6.37.4)](https://github.com/sequelize/sequelize/releases/tag/v6.37.4)\n- [NVD CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69240)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69240) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T05:31:41.629580Z"} {"uuid": "74d7cbd7-3889-4468-8e87-be7a6ecd862f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://gist.github.com/alon710/d6efe0abb614ef8ea563c1fdaaf1246b", "content": "# CVE-2026-69240: CVE-2026-69240: SQL Injection Vulnerability in Sequelize ORM Oracle Dialect\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69240\n\n## Summary\nA critical SQL injection vulnerability was discovered in Sequelize when configured to use the Oracle database dialect. Due to a flawed optimization design in the SQL escaping subsystem (src/sql-string.js), strings that begin with native Oracle date functions bypass standard escaping. This allows unauthenticated remote attackers to execute arbitrary SQL commands on the target database.\n\n## TL;DR\nSequelize versions prior to 6.37.4 fail to escape single quotes when string inputs start with TO_DATE or TO_TIMESTAMP, leading to critical SQL injection in applications using the Oracle dialect.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: None (UI:N)\n- **Impact**: Confidentiality, Integrity, Availability (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using Sequelize ORM with Oracle database backend\n- **sequelize**: < 6.37.4 (Fixed in: `6.37.4`)\n\n## Mitigation\n\n- Upgrade Sequelize to version 6.37.4 or later\n- Implement input sanitization rules to block TO_DATE and TO_TIMESTAMP prefixes\n- Use parameterized bind variables where possible to isolate data from commands\n\n**Remediation Steps:**\n1. Identify all service deployments using Sequelize with the Oracle database dialect.\n2. Update the package.json file to specify sequelize version ^6.37.4.\n3. Execute npm install or yarn install to apply the patch.\n4. Validate that all application tests pass and deploy the changes.\n\n## References\n\n- [GitHub Security Advisory GHSA-v8fg-2rw7-q452](https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452)\n- [Sequelize Release Note (v6.37.4)](https://github.com/sequelize/sequelize/releases/tag/v6.37.4)\n- [NVD CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-69240)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69240) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T05:31:41.629580Z"} https://vulnerability.circl.lu/sighting/74d7cbd7-3889-4468-8e87-be7a6ecd862f/export Tue, 04 Aug 2026 05:31:41 +0000 https://vulnerability.circl.lu/sighting/7cdee7c6-5443-4c46-9cc7-57ba646a8b26/export {"uuid": "7cdee7c6-5443-4c46-9cc7-57ba646a8b26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69240", "type": "published-proof-of-concept", "source": "https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452", "content": "", "creation_timestamp": "2026-08-03T22:35:08.866721Z"} {"uuid": "7cdee7c6-5443-4c46-9cc7-57ba646a8b26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69240", "type": "published-proof-of-concept", "source": "https://github.com/sequelize/sequelize/security/advisories/GHSA-v8fg-2rw7-q452", "content": "", "creation_timestamp": "2026-08-03T22:35:08.866721Z"} https://vulnerability.circl.lu/sighting/7cdee7c6-5443-4c46-9cc7-57ba646a8b26/export Mon, 03 Aug 2026 22:35:08 +0000 https://vulnerability.circl.lu/sighting/1b133c9f-37c7-415d-bfc3-9662e5baf38f/export {"uuid": "1b133c9f-37c7-415d-bfc3-9662e5baf38f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7iowh6z32g", "content": "\ud83d\udd34 CVE-2026-69240 - Critical (9.8)\n\nSequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-69240/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-03T22:00:16.757740Z"} {"uuid": "1b133c9f-37c7-415d-bfc3-9662e5baf38f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7iowh6z32g", "content": "\ud83d\udd34 CVE-2026-69240 - Critical (9.8)\n\nSequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-69240/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-03T22:00:16.757740Z"} https://vulnerability.circl.lu/sighting/1b133c9f-37c7-415d-bfc3-9662e5baf38f/export Mon, 03 Aug 2026 22:00:16 +0000 https://vulnerability.circl.lu/sighting/c9059df3-5425-4567-be08-4199ff9dca08/export {"uuid": "c9059df3-5425-4567-be08-4199ff9dca08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms7fkh4ivf2h", "content": "CVE-2026-69240 - sequelize\nSequelize, a database library, has a vulnerability that allows attackers to inject malicious SQL code when using the Oracle dialect. This can lead to data theft and tampering. To fix\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sequelize #npm #CVE #infosec", "creation_timestamp": "2026-08-03T21:04:04.896099Z"} {"uuid": "c9059df3-5425-4567-be08-4199ff9dca08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69240", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms7fkh4ivf2h", "content": "CVE-2026-69240 - sequelize\nSequelize, a database library, has a vulnerability that allows attackers to inject malicious SQL code when using the Oracle dialect. This can lead to data theft and tampering. To fix\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sequelize #npm #CVE #infosec", "creation_timestamp": "2026-08-03T21:04:04.896099Z"} https://vulnerability.circl.lu/sighting/c9059df3-5425-4567-be08-4199ff9dca08/export Mon, 03 Aug 2026 21:04:04 +0000