Detections
Analytics

SCA: security update for sequelize (GHSA-v8fg-2rw7-q452)

critical Tenable Cloud Security Plugin ID 445595

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect
 is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts
 with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or
 TO_DATE, escape returns val directly instead of replacing single quotes. An attacker can inject arbitrary
 SQL expressions through an application value that reaches this escape path. This issue is fixed in version
 6.37.4. (CVE-2026-69240)

Solution

Update the sequelize library and its related packages to version 6.37.4 or later.

See Also

https://github.com/advisories/GHSA-v8fg-2rw7-q452

Plugin Details

Severity: Critical

ID: 445595

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/4/2026

Updated: 8/4/2026

Risk Information

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-69240

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/3/2026

Vulnerability Publication Date: 8/3/2026

Reference Information

CVE: CVE-2026-69240

cwe: CWE-89