Live › vulnerability › CVE-2026-61620
HoneySQL, a Clojure library that builds SQL from data structures, fails to apply its suspicious-character check to some identifier names created with keyword or symbol. An attacker who controls that input can inject SQL that runs against the database with the connection's privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Applications that pass user input or other arbitrary data into HoneySQL's DSL through keyword or symbol calls, and then execute the generated SQL through a JDBC driver, are exposed. Applications that only use fixed, developer-written identifiers or that do not build SQL with HoneySQL are not affected by this flaw. The impact depends on the privileges of the database connection.
No product ranges from the sources yet.
keyword or symbol that receive user input before passing into HoneySQL's DSLdeps.edn or project.clj against the affected range 2.0.0 to 2.7.13922.7.1392 or laterkeyword or symbol entities (workaround stated in the source)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL DSL by calling keyword or symbol on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a JDBC driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing keyword or symbol entities is a workaround. The maintainer-designated fixed version is 2.7.1392.
This page as .md · .json · in your agent: get_signal("CVE-2026-61620")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.