{"id":"CVE-2026-61620","published":"2026-10-30T20:17:10.967","lastModified":"2026-10-30T23:17:11.647","description":"HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/seancorfield/honeysql/commit/1141fcd4597393d2af61c20a7cc82b8f1b3cea4a","tags":[]},{"url":"https://github.com/seancorfield/honeysql/compare/v2.7.1390...v2.7.1392","tags":[]},{"url":"https://github.com/seancorfield/honeysql/releases/tag/v2.7.1392","tags":[]},{"url":"https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97","tags":[]}],"exploitRefs":[{"url":"https://github.com/seancorfield/honeysql/commit/1141fcd4597393d2af61c20a7cc82b8f1b3cea4a","tags":[]},{"url":"https://github.com/seancorfield/honeysql/compare/v2.7.1390...v2.7.1392","tags":[]},{"url":"https://github.com/seancorfield/honeysql/releases/tag/v2.7.1392","tags":[]},{"url":"https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97","tags":[]}],"hasPoc":true,"ai":{"summary":"HoneySQL versions before 2.7.1392 fail to sanitize user-controlled input when converting Clojure keywords or symbols into SQL identifiers, enabling SQL injection via unsanitized entity names in certain formatters.","exploitability":"Exploitation is straightforward for attackers with control over user input passed directly into DSL keyword/symbol construction, requiring no authentication or user interaction.","blast_radius":"Successful exploitation could lead to full database compromise—including data exfiltration, modification, or deletion—depending on the database connection's privilege level.","remediation":"Upgrade to HoneySQL version 2.7.1392 or later; as an immediate workaround, validate and sanitize all user input before converting it to Clojure keywords or symbols.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","clojure","web","input-validation"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:47:24.789Z"}}