Skip to content

CVE-2026-61620 HoneySQL unchecked entity names can lead to SQL injection results

CriticalCVSS 9.8 EPSS 0.39%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL DSL by calling keyword or symbol on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a JDBC driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing keyword or symbol entities is a workaround. The maintainer-designated fixed version is 2.7.1392.

Affected products

ProductAffected versionsFixed in
seancorfield honeysql = >= 2.0.0, < 2.7.1392 No fix listed

References