HoneySQL CVE-2026-61620 (CVSS 9.8) enables SQL injection via keyword or symbol input
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- HoneySQL
- Product
- HoneySQL
- First seen
Summary
TheHackerWire reports CVE-2026-61620, a critical (CVSS 9.8) SQL injection flaw in HoneySQL versions 2.0.0 through 2.7.1392. The flaw applies when applications pass user input into the DSL via keyword or symbol calls.
If you use HoneySQL
Upgrade HoneySQL to a version later than 2.7.1392
Audit code that passes user input to keyword or symbol calls
Review database logs for suspicious query patterns
Upgrade honeysql to 2.7.1392 or later
Stop passing untrusted input to keyword or symbol in HoneySQL DSL calls
Audit queries built from user-controlled data for injection
What the sources say 2
· Mastodon: “From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQ...” Source
· Mastodon: “From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL i” Source