CVE-2026-61620

Name of the Vulnerable Software and Affected Versions HoneySQL versions 2.0.0 through 2.7.1391

Description Applications that pass user input or arbitrary data into the DSL by calling keyword or symbol on that input can produce SQL strings that facilitate SQL injection when executed by a JDBC driver. This occurs because some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact of this issue depends on the privileges of the database connection executing the generated statement.

Recommendations Update to version 2.7.1392. Perform input validation before constructing keyword or symbol entities.