---
id: CVE-2026-61620
title: HoneySQL unchecked entity names can lead to SQL injection results
summary: >-
  HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392,
  applications that pass user input or other arbitrary data into the HoneySQL
  `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings
  that fac…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-89
vendor: seancorfield
product: honeysql
affected:
  - 'honeysql >= 2.0.0, < 2.7.1392'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-30T22:08:44.902818Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T22:14:44.078Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61620'
references:
  - url: >-
      https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97
    label: >-
      https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97
  - url: >-
      https://github.com/seancorfield/honeysql/commit/1141fcd4597393d2af61c20a7cc82b8f1b3cea4a
    label: >-
      https://github.com/seancorfield/honeysql/commit/1141fcd4597393d2af61c20a7cc82b8f1b3cea4a
  - url: 'https://github.com/seancorfield/honeysql/compare/v2.7.1390...v2.7.1392'
    label: 'https://github.com/seancorfield/honeysql/compare/v2.7.1390...v2.7.1392'
  - url: 'https://github.com/seancorfield/honeysql/releases/tag/v2.7.1392'
    label: 'https://github.com/seancorfield/honeysql/releases/tag/v2.7.1392'
tags:
  - cve.org
epss: 0.00392
epssPercentile: 0.33534
ingestedAt: '2026-11-05T16:24:31.474Z'
---

## Overview

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.

## Affected

- `honeysql >= 2.0.0, < 2.7.1392`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.