External risk intelligence

HoneySQL SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-61620

HoneySQL is a library embedded within applications to construct SQL queries. While it is not an internet-facing service itself, it is commonly used in web applications that process user input. Its reachability depends entirely on whether the specific application consuming the library exposes a vulnerable endpoint to the internet, which makes internet exposure possible but not inherent to the library's design.

SQL Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the HoneySQL library, which is used to generate SQL queries from data structures. This issue could allow attackers to inject malicious SQL commands into your applications, potentially leading to unauthorized access or modification of sensitive data stored in databases. The severity depends on the database connection's permissions.

Allows attackers to insert malicious SQL commands.
Matters due to potential data compromise and unauthorized access.
Confirm if HoneySQL is used and assess exposure risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending crafted data to an application that uses a vulnerable version of HoneySQL. If the application passes this data directly to HoneySQL's `DSL` by calling `keyword` or `symbol`, it can generate malicious SQL. This SQL, when executed by a JDBC driver, could lead to unauthorized access or manipulation of the database.

Requires an application using the library.
Triggered by unsanitized user input.
Risk of unauthorized database access.

Live Threat

Current exploitation, exposure, and threat context

Applications using this library could allow attackers to inject malicious SQL commands into database queries. This occurs when user-supplied data is processed in a way that bypasses security checks before being converted into SQL strings by the library. The potential impact hinges on the database connection's privileges.

Database integrity and confidentiality.
User input is directly incorporated into SQL.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners, likely those responsible for Clojure-based systems, should prioritize identifying where HoneySQL is used. The first practical step involves confirming exposure and business criticality of affected applications, then locating the accountable owner to plan remediation based on risk.

Application owners should address this.
Verify user input handling first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is HoneySQL and where is it used?

HoneySQL is a library for the Clojure programming language that converts data structures into SQL queries. Developers use it to build dynamic database queries programmatically rather than writing raw SQL strings. It is typically embedded within the backend of Clojure-based web applications or services, acting as a middleware component that facilitates communication between the application logic and the database.

How does CVE-2026-61620 lead to SQL injection?

This vulnerability relates to CWE-89: Improper Neutralization of Special Elements used in an SQL Command. It occurs when an application converts unsanitized user input into database identifiers using 'keyword' or 'symbol' functions before passing them to the HoneySQL DSL. Because some formatters fail to check these resulting entity names for malicious characters, an attacker can manipulate the generated SQL string to execute unauthorized database commands.

What specifically triggers this vulnerability?

The flaw is triggered when an application directly incorporates untrusted user input into database queries via HoneySQL's 'keyword' or 'symbol' helpers. It is not triggered if the application uses HoneySQL's standard data structure features without passing raw user input through these specific conversion functions. Proper input validation before the data reaches these functions effectively prevents the malicious injection path.

Is my application vulnerable according to Halo Surface Signal?

Halo Surface Signal notes that HoneySQL is a library, not a standalone service, so its reachability depends on your specific application design. While the library itself is not inherently internet-facing, it is often used in web applications that process external requests. You are at risk if your application exposes an endpoint that passes unsanitized user input into the vulnerable HoneySQL functions.

How do I secure my application against this issue?

First, perform an inventory to locate all instances of HoneySQL in your codebase. Identify any code paths where user-provided data is passed into 'keyword' or 'symbol' functions. The primary remediation is to update to version 2.7.1392 or later. If an immediate update is not possible, implement strict input validation to sanitize or restrict user data before it is processed by the library.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.