CVE-2026-61620
CriticalCVSS 9.8Summary
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications passing user input into the DSL via keyword or symbol can produce SQL strings vulnerable to SQL injection because some formatters do not apply the suspicious-character check to entity names.
Risk Assessment
Potential SQL injection with the privileges of the database connection, risking unauthorized data access or modification.
Recommendation
Update HoneySQL to version 2.7.1392 or later; as a workaround, validate input before constructing keyword or symbol entities.
Related vulnerabilities
- CVE-2026-78403Critical
Stack-based buffer overflow and missing authorization in Thales Sentinel Keys Server on Windows. The server does not check the length of the first field in an HTTP request, allowing an attacker to send a crafted request and potentially achieve remote code execution as NT AUTHORITY\SYSTEM.
- CVE-2026-61850Critical
Kargo versions from 0.6.0 until 1.8.14, 1.9.9, and 1.10.8 contain two authorization flaws in the project-scoped RBAC API. An authenticated user with delegated permission to manage a Project's Roles or ServiceAccounts can confer permissions exceeding their own, enabling escalation to Project-administrator access.
- CVE-2026-55598Critical
PinePods before 0.9.0 allows an authenticated user to subscribe to an attacker-controlled RSS feed whose enclosure URL is stored without host/IP validation. The server performs GET/HEAD requests to internal services, enabling service enumeration, data disclosure, and cloud metadata credential theft.
- CVE-2026-116241Critical
pgAdmin 4 before 9.19 contains a bypass of the CVE-2026-17566 fix in the Import/Export Data tool. Improper validation of a backslash inside a double-quoted identifier hides a closing parenthesis and executes a TO PROGRAM clause via psql on the pgAdmin host with the OS account privileges.
- CVE-2026-90888Critical
The LeadSnap WordPress plugin in versions up to 1.25 contains an unauthenticated PHP Object Injection vulnerability.
- CVE-2026-39738Critical
The FunnelKit Automations WordPress plugin in versions up to 3.8.6.1 contains an unauthenticated PHP Object Injection vulnerability.
- CVE-2026-39732Critical
The Transliterator WordPress plugin in versions up to 2.5.13 contains an unauthenticated SQL Injection vulnerability.
- CVE-2026-119526Critical
The ThemeREX Royal Event WordPress theme in versions up to 2.0 contains a deserialization of untrusted data vulnerability allowing object injection.
- CVE-2026-116852Critical
The Widget Options WordPress plugin in versions up to 4.2.5 contains an author-level Remote Code Execution (RCE) vulnerability.
- CVE-2026-116386Critical
The SMS Alert Order Notifications WordPress plugin in versions up to 4.0.2 contains an unauthenticated privilege escalation vulnerability.
Original NVD description (English source)
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS