HoneySQL converts Clojure data structures into SQL strings. From version 2.0.0 through 2.7.1392, if an application passes untrusted user data into the DSL by calling keyword or symbol on that data, the resulting entity names are not always checked for suspicious characters. This flaw allows an attacker to inject arbitrary SQL when the statement is executed by a JDBC driver, potentially compromising any data the database account can access.

The vulnerability affects the HoneySQL library produced by seancorfield. All projects using HoneySQL versions 2.0.0 up to and including 2.7.1392 are at risk. The fix is available in version 2.7.1392 and later.

The CVSS score of 9.8 indicates a critical severity. The EPSS score is not available, but the lack of a CISA KEV listing suggests no public exploitation yet. The likely attack vector is via an application that accepts user-supplied data and passes it directly to HoneySQL's keyword or symbol functions without validation. If the database user has high privileges, an attacker may gain full control of the database or exfiltrate sensitive information.