CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath and also has access to these REST interface for calling the mentioned REST endpoints, using these lines of code can lead to unintended remote code execution. This vulnerability is fixed in 5.9.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jhipster | generator-jhipster-entity-audit | before 5.9.1 | 5.9.1 | Patch available | CNA |
| — | generator-jhipster-entity-audit (npm) | before 5.9.1 | 5.9.1 | Patch available | GHSA-7rmp-3g9f-cvq8 |
- generator-jhipster-entity-audit Vendorjhipster Affected before 5.9.1 Fixed in 5.9.1 Patch available CNA
- generator-jhipster-entity-audit (npm) Vendor— Affected before 5.9.1 Fixed in 5.9.1 Patch available GHSA-7rmp-3g9f-cvq8
Remediation
- Fix · CNA generator-jhipster-entity-audit (jhipster) Fixed in 5.9.1
- Fix · GHSA-7rmp-3g9f-cvq8 generator-jhipster-entity-audit (npm) Fixed in 5.9.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-31119
- 2026-10-03 Alias added: GHSA-7rmp-3g9f-cvq8
References
Other 3
- https://github.com/jhipster/generator-jhipster-entity-audit/security/advisories/GHSA-7rmp-3g9f-cvq8
- https://github.com/jhipster/generator-jhipster-entity-audit/blob/e21e83135d10c77d92203c89cb0b0063914e8fe0/generators/spring-boot-javers/templates/src/main/java/_package_/web/rest/JaversEntityAuditResource.java.ejs#L88
- https://github.com/jhipster/generator-jhipster-entity-audit
More jhipster vulnerabilities
- TI-2025-28302 Improper access control in JHipster CVSS 3.1HIGH 8.0
- TI-2022-08628 SQL Injection when creating an application with Reactive SQL backend CVSS 3.1HIGH 8.1
- TI-2026-69607 Stored cross-site scripting in JHipster generated applications CVSS 3.1HIGH 7.6
- TI-2019-12273 A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through… CVSS 3.1CRITICAL 9.8
- TI-2026-69614 SQL injection in JHipster reactive applications via sort parameter CVSS 3.1HIGH 8.8
- TI-2015-08085 JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken… CVSS 3.1HIGH 7.5
Sources
- CVE-2025-31119 · CVE Program
- CVE-2025-31119 · NVD
- FIRST EPSS
- GHSA-7rmp-3g9f-cvq8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences