[GHSA] GHSA-v8fg-2rw7-q452 (critical) — Sequelize: SQL Injection (Oracle DB)

GHSA-v8fg-2rw7-q452 Severity: critical CVE: CVE-2026-69240

Sequelize: SQL Injection (Oracle DB)

### Summary SQL Injection is possible with strings only **if dialect is set to `oracle`**. The vulnerability was confirmed on Sequelize v6.37.3.

### Details The `escape` function defined in `sql-string.js` does not escape quotes if the value starts with `TO_TIMESTAMP` or `TO_DATE`.

```javascript }