CVE-2026-61620
9.8 CRITICALpublic exploit availablePublished 2026-10-30 · Updated 2026-10-30
AI risk analysis
- Summary
- HoneySQL versions before 2.7.1392 fail to sanitize user-controlled input when converting Clojure keywords or symbols into SQL identifiers, enabling SQL injection via unsanitized entity names in certain formatters.
- Exploitability
- Exploitation is straightforward for attackers with control over user input passed directly into DSL keyword/symbol construction, requiring no authentication or user interaction.
- Blast radius
- Successful exploitation could lead to full database compromise—including data exfiltration, modification, or deletion—depending on the database connection's privilege level.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to HoneySQL version 2.7.1392 or later; as an immediate workaround, validate and sanitize all user input before converting it to Clojure keywords or symbols.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Public exploit & PoC references
- https://github.com/seancorfield/honeysql/commit/1141fcd4597393d2af61c20a7cc82b8f1b3cea4a
- https://github.com/seancorfield/honeysql/compare/v2.7.1390...v2.7.1392
- https://github.com/seancorfield/honeysql/releases/tag/v2.7.1392
- https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97
All references
- https://github.com/seancorfield/honeysql/commit/1141fcd4597393d2af61c20a7cc82b8f1b3cea4a
- https://github.com/seancorfield/honeysql/compare/v2.7.1390...v2.7.1392
- https://github.com/seancorfield/honeysql/releases/tag/v2.7.1392
- https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2015-20122
- HIGHCVE-2022-4997
- CRITICALCVE-2023-54399
- CRITICALCVE-2023-54400PoC
- HIGHCVE-2025-57739
- CRITICALCVE-2025-63564
- HIGHCVE-2026-100683PoC
- HIGHCVE-2026-100847PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.