Sequelize: SQL Injection (Oracle DB)

Summary SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3. Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. javascript else if dialect === 'oracle...