Sequelize’s Oracle dialect can turn attacker-controlled text into executable SQL when the string starts with TO_TIMESTAMP or TO_DATE. The failure is in the ORM’s escape logic: instead of quoting those values, it returns them unchanged, so applications that trust Sequelize to sanitize user input lose that protection at the database boundary. INCIBE-CERT says the issue affects Sequelize versions before 6.37.4 and is tracked as CVE-2026-69240. It is limited to the Oracle dialect, and a value that reaches the escape path can be used to inject arbitrary SQL, which makes this a direct patch item for Node.js apps that pass user data into ORM-managed queries.