An SQL injection vulnerability in the Sequelize ORM for Node.js allows unauthenticated attackers to execute arbitrary database commands when using the Oracle dialect.

The vulnerability exists in the escape function within sql-string.js, which fails to properly sanitize strings beginning with TO_TIMESTAMP or TO_DATE. This allows an unauthenticated attacker to bypass security controls and inject arbitrary SQL expressions into database queries.

The ability to perform SQL injection poses a severe risk to data integrity, confidentiality, and availability. Successful exploitation could lead to unauthorized access to sensitive application data, database modification, or complete system compromise, justifying the 9.8 CVSS score.

Immediate Action: Update the Sequelize package to version 6.37.4 or later immediately.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected SQL syntax or attempts to manipulate date fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting database-specific functions.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk for any application utilizing Sequelize with the Oracle dialect. Administrators must prioritize updating the dependency to version 6.37.4 to ensure that the escape logic is correctly applied and the injection vector is neutralized.