HoneySQL: SQL injection via unchecked keyword and symbol entity names
Summary
HoneySQL converts Clojure data structures into SQL. Some formatters do not apply the suspicious-character check to entity names created from user input via keyword or symbol, so generated SQL can contain injected statements. An attacker can exploit this if an application passes attacker-controlled data into these functions and the generated SQL is executed by a JDBC driver; the impact depends on the database connection's privileges.
Affected
- HoneySQL versions from 2.0.0 up to, but not including, 2.7.1392
- Applications that pass user input or other arbitrary data into keyword or symbol in the HoneySQL DSL
Fixed in
- Upgrade to HoneySQL 2.7.1392 or later (maintainer-designated fixed version)
- Verify the newest 2.8.x release line on the maintainer's release page before choosing a target version
Workaround
- Validate user input before it is passed to keyword or symbol (fallback only; upgrading is the preferred fix)
Exploitation
- No known exploitation reported at the time of writing.
- No public proof of concept identified.
Our recommendation
- Inventory all HoneySQL dependencies, including those inside vendor products, and their versions (deps.edn, Maven or Leiningen lockfiles).
- Upgrade HoneySQL to 2.7.1392 or later; for vendor products, apply the vendor's patched release.
- If an upgrade is not possible, validate all input reaching keyword or symbol calls.
- Use database accounts with minimal privileges for these applications.
- Monitor for public proof of concept and changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub security advisory GHSA-fcfq-xqgp-8v97 github.com
- HoneySQL release v2.7.1392 github.com
- HoneySQL commit 1141fcd github.com
- HoneySQL compare v2.7.1390...v2.7.1392 github.com
- Metabase security advisory GHSA-r495-55cx-fjh7 github.com
- OffSeq threat radar entry CVE-2026-61620 radar.offseq.com
- Clojars HoneySQL 2.7.1392 clojars.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:20.
Original description (NVD)
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.
NVD references (4)
- https://github.com/seancorfield/honeysql/commit/1141fcd4597393d2af61c20a7cc82b8f1b3cea4a
- https://github.com/seancorfield/honeysql/compare/v2.7.1390...v2.7.1392
- https://github.com/seancorfield/honeysql/releases/tag/v2.7.1392
- https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.