Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔴 seancorfield honeysql: sql injection via unchecked entity names in query DSL (CVE-2026-61620) An attacker can inject SQL that runs against the database, with impact depending on the connection's privileges. Patch → 2.7.1392 https://cve.now/CVE-2026-61620?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical