{"id":"CVE-2026-61620","title":"HoneySQL unchecked entity names can lead to SQL injection results","summary":"HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that fac…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-89"],"vendor":"seancorfield","product":"honeysql","affected":["honeysql >= 2.0.0, < 2.7.1392"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-30T22:08:44.902818Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T22:14:44.078Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-61620","references":[{"url":"https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97","label":"https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97"},{"url":"https://github.com/seancorfield/honeysql/commit/1141fcd4597393d2af61c20a7cc82b8f1b3cea4a","label":"https://github.com/seancorfield/honeysql/commit/1141fcd4597393d2af61c20a7cc82b8f1b3cea4a"},{"url":"https://github.com/seancorfield/honeysql/compare/v2.7.1390...v2.7.1392","label":"https://github.com/seancorfield/honeysql/compare/v2.7.1390...v2.7.1392"},{"url":"https://github.com/seancorfield/honeysql/releases/tag/v2.7.1392","label":"https://github.com/seancorfield/honeysql/releases/tag/v2.7.1392"}],"tags":["cve.org"],"epss":0.00392,"epssPercentile":0.33534,"ingestedAt":"2026-11-05T16:24:31.474Z","slug":"CVE-2026-61620","body":"## Overview\n\nHoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.\n\n## Affected\n\n- `honeysql >= 2.0.0, < 2.7.1392`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}