Read the docs
TI-2026-69614 Aliases CVE-2026-107375GHSA-r223-96jv-q533

SQL injection in JHipster reactive applications via sort parameter

Priority MEDIUM 40CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

JHipster generator-jhipster from 7.0.0 before 9.4.0 generates reactive applications that pass the sort request parameter into an SQL ORDER BY clause without validation or quoting (CWE-89). An authenticated remote user with low privileges can run additional SQL statements through the sort parameter, reading, changing or deleting data and dropping tables. Non-reactive JPA applications and NoSQL backends are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated entity-list endpoints into createOrderByFields in generators/spring-boot/generators/data-relational/templates/src/main/java/package/repository/EntityManager_reactive.java.ejs. The generated code renders these properties into the SQL ORDER BY clause without validation or quoting, and the R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can consequently read sensitive tables, modify or delete data, or drop tables, while non-reactive JPA applications and NoSQL backends are outside this root cause. This issue is fixed in 9.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00433 37th percentileScored 2026-11-07
Fix Fixed generator-jhipster (jhipster): 9.4.0generator-jhipster (npm): 9.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jhipstergenerator-jhipster7.0.0 to before 9.4.09.4.0Patch availableCNA
—generator-jhipster (npm)7.0.0 to before 9.4.09.4.0Patch availableGHSA-r223-96jv-q533
  • generator-jhipster Vendorjhipster Affected 7.0.0 to before 9.4.0 Fixed in 9.4.0 Patch available CNA
  • generator-jhipster (npm) Vendor— Affected 7.0.0 to before 9.4.0 Fixed in 9.4.0 Patch available GHSA-r223-96jv-q533

Remediation

Upgrade generator-jhipster to version 9.4.0, which fixes the issue. Applications already generated with an affected version must be regenerated or patched with the fixed templates.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA generator-jhipster (jhipster) Fixed in 9.4.0
  • Fix · GHSA-r223-96jv-q533 generator-jhipster (npm) Fixed in 9.4.0 Advisory →

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107375
  2. 2026-10-08 Alias added: GHSA-r223-96jv-q533
  3. 2026-10-10 CISA SSVC decision points changed
  4. 2026-10-10 Priority changed: MEDIUM → LOW
  5. 2026-10-10 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2025-28302 Improper access control in JHipster CVSS 3.1HIGH 8.0
  • TI-2022-08628 SQL Injection when creating an application with Reactive SQL backend CVSS 3.1HIGH 8.1
  • TI-2025-22380 CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework CVSS 3.1HIGH 7.7
  • TI-2026-69607 Stored cross-site scripting in JHipster generated applications CVSS 3.1HIGH 7.6
  • TI-2019-12273 A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through… CVSS 3.1CRITICAL 9.8
  • TI-2015-08085 JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken… CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences