Threats tagged 'ghsa-v8fg-2rw7-q452'

Sequelize versions prior to 6.37.4 contain a critical SQL Injection vulnerability when used with the Oracle dialect. The vulnerability arises because the escape function does not properly escape strings starting with TO_TIMESTAMP or TO_DATE, allowing crafted input to inject arbitrary SQL. This can lead to data theft and tampering. A patch is available to address this issue.