{"id":"CVE-2026-61620","kind":"vulnerability","aliases":["CVE-2026-61620"],"related":[],"title":"HoneySQL: user input turned into SQL identifiers enables SQL injection","description":"HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.","summary":"HoneySQL, a Clojure library that builds SQL from data structures, fails to apply its suspicious-character check to some identifier names created with keyword or symbol. An attacker who controls that input can inject SQL that runs against the database with the connection's privileges.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clojure","honeysql","jdbc","package","sql"],"not_affected_if":["fixed-identifiers","honeysql-not-used","no-user-input-to-keyword"],"how_to_check":"- Search your Clojure projects for calls to `keyword` or `symbol` that receive user input before passing into HoneySQL's `DSL`\n- Check the HoneySQL version in your `deps.edn` or `project.clj` against the affected range `2.0.0` to `2.7.1392`","fix":"- HoneySQL: move to `2.7.1392` or later\n- Until upgraded, validate input before constructing `keyword` or `symbol` entities (workaround stated in the source)","status":"open","published_at":"2026-10-30T20:17:10+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:06+00:00","updated_at":"2026-10-30T20:26:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T20:26:06Z","model":"claude-haiku-5-5","output":{"fix":"- HoneySQL: move to `2.7.1392` or later\n- Until upgraded, validate input before constructing `keyword` or `symbol` entities (workaround stated in the source)","reach":"internet","title":"HoneySQL: user input turned into SQL identifiers enables SQL injection","impact":"high","summary":"HoneySQL, a Clojure library that builds SQL from data structures, fails to apply its suspicious-character check to some identifier names created with keyword or symbol. An attacker who controls that input can inject SQL that runs against the database with the connection's privileges.","audience":"developers","category":"package","nicknames":[],"who_cares":["clojure","honeysql","jdbc","sql"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker runs arbitrary SQL with the database connection's privileges","analyst_note":"Confirm the affected range and fix from the maintainer advisory or GitHub advisory; NVD entry alone gives only the fixed version.","how_to_check":"- Search your Clojure projects for calls to `keyword` or `symbol` that receive user input before passing into HoneySQL's `DSL`\n- Check the HoneySQL version in your `deps.edn` or `project.clj` against the affected range `2.0.0` to `2.7.1392`","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-identifiers","no-user-input-to-keyword","honeysql-not-used"],"who_is_affected":"Applications that pass user input or other arbitrary data into HoneySQL's DSL through keyword or symbol calls, and then execute the generated SQL through a JDBC driver, are exposed. Applications that only use fixed, developer-written identifiers or that do not build SQL with HoneySQL are not affected by this flaw. The impact depends on the privileges of the database connection.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000762,"input_tokens":4224,"output_tokens":680,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-61620':13A,16A '2.0.0':76C '2.7.1392':78C,163C 'appli':34B,119C 'applic':79C 'arbitrari':86C 'attack':50B 'build':27B 'call':93C 'charact':38B,124C 'check':39B,125C 'clojur':17B,24B,70C 'connect':65B,140C 'construct':148C 'control':52B 'creat':44B 'cve':11A,14A 'data':30B,71C,87C 'databas':62B,139C 'depend':133C 'design':159C 'driver':114C 'dsl':91C 'enabl':8A 'entiti':129C,152C 'execut':109C,141C 'exist':121C 'facilit':105C 'fail':32B 'fix':160C 'formatt':116C 'generat':143C 'honeysql':1A,18B,22B,68C,90C 'identifi':7A,42B 'impact':132C 'inject':10A,56B,107C 'input':3A,54B,83C,99C,145C 'jdbc':19B,113C 'keyword':46B,94C,149C 'librari':25B 'maintain':158C 'maintainer-design':157C 'name':43B,130C 'packag':20B 'pass':81C 'privileg':67B,136C 'produc':101C 'result':128C 'run':59B 'sql':6A,9A,21B,28B,57B,74C,102C,106C 'statement':144C 'string':103C 'structur':31B,72C 'suspici':37B,123C 'suspicious-charact':36B,122C 'symbol':48B,96C,151C 'turn':4A,69C 'unchang':110C 'user':2A,82C 'valid':146C 'version':161C 'workaround':155C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass user input or other arbitrary data into HoneySQL's DSL through keyword or symbol calls, and then execute the generated SQL through a JDBC driver, are exposed. Applications that only use fixed, developer-written identifiers or that do not build SQL with HoneySQL are not affected by this flaw. The impact depends on the privileges of the database connection.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T20:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61620","severity":null,"published_at":"2026-10-30T20:17:10+00:00","modified_at":"2026-10-30T20:17:10+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}