A high‑severity SQL injection flaw exists in Sequelize prior to version 6.37.4 when the Oracle dialect is used. The escape function in sql‑string.js fails to escape single quotes for values that start with TO_TIMESTAMP or TO_DATE, allowing an attacker to inject arbitrary SQL via user input that is sent to the database. This flaw can be exploited to execute unintended SQL statements, potentially exposing or compromising sensitive data.

The vulnerability affects the Sequelize Node.js ORM (sequelize:sequelize). All releases before 6.37.4 are impacted. The fix is included in Sequelize v6.37.4 and later.

The flaw carries a CVSS score of 9.8, indicating critical severity. EPSS information is not available and the issue is not listed in the CISA KEV catalog. Exploitation is likely if an application uses the Oracle dialect and accepts untrusted input starting with TO_DATE or TO_TIMESTAMP. The likely attack vector is through web or API input channels that forward raw user strings to Sequelize; this inference comes from the fact that injection occurs when unfiltered user values hit the escape function. An unauthenticated attacker could inject malicious SQL by sending crafted input through these channels.