There's a SQL injection vulnerability in Sequelize's Oracle dialect (CVE-2026-69240) that you need to act on now. The issue lives in the escape function: when it detects a string starting with TO_TIMESTAMP or TO_DATE, it returns the value directly without escaping — essentially treating that prefix as a trust signal. This means any value reaching the escape function with those prefixes gets interpolated into the SQL query as a literal string rather than a bound parameter.
If you're using Sequelize with Oracle, check your sql-string.js or equivalent escape implementation. The vulnerable pattern looks like: if (typeof val === 'string' && val.startsWith('TO_TIMESTAMP') || val.startsWith('TO_DATE')) — when this condition is true, the function returns val unchanged. This bypasses parameterized query protections entirely.
The fix in version 6.37.4 addresses this specific case, but there's a deeper structural problem: the pattern-matching-as-trust-boundary approach is a known vulnerability genotype that tends to reproduce. Every time Oracle's syntax requires a literal string rather than a parameter, the fix adds another branch doing the same thing — checking a string prefix and returning input directly. This is a growing attack surface.
What to do: First, upgrade to 6.37.4 immediately. Second, audit your codebase for any manually constructed TO_TIMESTAMP, TO_DATE, or similar Oracle function calls that might be concatenating user input — the ORM patch protects the escape function but doesn't fix insecure application logic. Third, review other Sequelize dialect implementations in your stack for similar pattern-matching shortcuts; the Oracle case was the first discovered but likely not the only one. The deployment reality matters here: Oracle with Sequelize typically runs in enterprise environments with longer patch cycles, so treat this as higher priority than the CVSS alone suggests.