CVE-2026-61620 in HoneySQL
Summary
by MITRE • 10/30/2026
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
HoneySQL is a widely used library in the Clojure ecosystem designed to translate data structures into SQL statements, thereby simplifying database interactions for developers. However, versions ranging from 2.0.0 up to and including 2.7.1392 contain a critical security flaw that allows for SQL injection attacks when user-controlled input is improperly handled during the construction of query components. The vulnerability stems from how the library processes inputs passed into its Domain Specific Language (DSL) via Clojure's `keyword` or `symbol` functions. When developers use these functions to wrap arbitrary data, such as values derived directly from user requests, without adequate sanitization, the resulting SQL strings can be manipulated by attackers to execute unintended commands on the underlying database system.
The technical root cause of this vulnerability lies in the insufficient validation applied to entity names within the generated SQL syntax. While HoneySQL includes mechanisms to detect and block suspicious characters in certain contexts, these checks are not consistently enforced across all formatters used for constructing identifiers such as table or column names. Consequently, if an attacker supplies a specially crafted string that bypasses existing filters through the `keyword` or `symbol` pathways, it can be embedded directly into the SQL query structure. This failure to properly sanitize input before entity name construction creates a direct pathway for malicious code injection, exploiting the trust placed in the library's automatic escaping mechanisms which are incomplete in this specific scenario.
The operational impact of this vulnerability is severe and highly dependent on the privileges associated with the database connection executing the compromised statement. If the application connects to the database using an account with elevated permissions, such as administrative rights or write access to sensitive tables, an attacker could potentially exfiltrate confidential data, modify records, delete critical information, or even execute system-level commands depending on the specific Database Management System in use. This represents a classic injection flaw where untrusted input is treated as executable code within the SQL context, undermining the integrity and confidentiality of the entire application's data layer.
From a classification perspective, this vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. Furthermore, it maps to MITRE ATT&CK technique T1059, specifically sub-techniques related command scripting or database commands, illustrating how attackers leverage application logic flaws to interact directly with backend systems. The vulnerability highlights the risks associated with dynamic code generation and the necessity of rigorous input validation in web applications that construct queries programmatically rather than using parameterized statements exclusively for all data types.
To mitigate this risk, developers must implement strict input validation before passing any user-supplied or arbitrary data into HoneySQL's `keyword` or `symbol` functions. This involves ensuring that only expected alphanumeric characters and safe delimiters are allowed in identifiers such as table names, column names, or other schema elements. Alternatively, applications should avoid using dynamic entity construction for untrusted input altogether, opting instead for parameterized queries where the data is separated from the query structure at a lower level within the JDBC driver layer. Organizations running affected versions must upgrade to version 2.7.1392 or later, which addresses these validation gaps and ensures that suspicious characters are properly neutralized across all formatting pathways used by the library.