HoneySQL unchecked entity names can lead to SQL injection results
HoneySQL 2.0.0 before 2.7.1392 is exposed when applications pass user input into its DSL via keyword or symbol. The fix is in 2.7.1392, and the CVSS score is 9.8 (critical).
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 2.7.1392
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
HoneySQL, a Clojure library that generates SQL from data structures, is affected when applications pass unvalidated user input into its query DSL as keyword or symbol names. This can let attackers inject SQL that runs against the database, with the severity depending on the privileges of the database connection.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- seancorfield honeysql
From 2.0.0 · fixed in 2.7.1392
References 4
GitHub · seancorfield/honeysql
Questions about CVE-2026-61620
What does this mean?
HoneySQL builds SQL statements from Clojure data. If application input is passed into its DSL by calling keyword or symbol on it, the generated SQL can allow SQL injection when a JDBC driver runs it.Source: github.com
Am I affected, and how do I check?
Versions from 2.0.0 before 2.7.1392 are in the affected range, and the issue applies only when user input or other arbitrary data is passed into HoneySQL's DSL through keyword or symbol. Readers can check their HoneySQL version in deps.edn or project.clj.Source: github.com
What should I do about it?
Upgrade to HoneySQL 2.7.1392 or later. Until then, validate input before calling keyword or symbol when constructing DSL structures.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data