CVE-2026-61620

{
  "etk_id": "ETK-2026-3111",
  "cve_id": "CVE-2026-61620",
  "display_id": "CVE-2026-61620",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-114395",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection through user-derived entity names in HoneySQL",
  "summary": "HoneySQL versions 2.0.0 through before 2.7.1392 can generate unsafe SQL when an application turns untrusted input into keyword or symbol values used by its DSL. An attacker may influence executed SQL when that generated statement is passed unchanged to a JDBC driver; impact depends on the database connection's privileges.",
  "mitigation": "Upgrade honeysql to version 2.7.1392 or later. Until upgraded, reject or strictly validate untrusted values before converting them to keywords or symbols for HoneySQL queries.",
  "vendor": "seancorfield",
  "product": "honeysql",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0, < 2.7.1392"
      ],
      "ecosystem": "clojars.org",
      "fixed_versions": [
        ">= 2.7.1392"
      ],
      "package_name": "com.github.seancorfield/honeysql",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.152933783333333,
  "t0_at": "2026-10-30T19:56:19.987000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-30T19:56:19.987000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T19:56:19.987000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61620"
    }
  }
}