TI-2026-76169 Aliases CVE-2026-112017 GHSA-j5cg-5m27-jqf8

SQL injection in JeecgBoot via SqlInjectionUtil newline bypass

LOW 31CWE-89Published 2026-10-18 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: SQL injection
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

JeecgBoot before 3.9.5 contains an SQL injection flaw in which the SqlInjectionUtil keyword blocklist can be bypassed by inserting newline characters into dictionary and online report SQL fragments (CWE-89). An authenticated remote attacker with low privileges can send newline-separated payloads to endpoints such as /sys/dict/getDictItems to run boolean or time-based blind injection. This allows extraction of database contents, including administrator password hashes from sys_user.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00282 20th percentileScored 2026-11-07

Fix Fixed JeecgBoot (jeecgboot): 3.9.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jeecgboot	JeecgBoot	before 3.9.5	3.9.5	Patch available	CNA

JeecgBoot Vendorjeecgboot Affected before 3.9.5 Fixed in 3.9.5 Patch available CNA

Remediation

Upgrade JeecgBoot to version 3.9.5.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA JeecgBoot (jeecgboot) Fixed in 3.9.5

Timeline

2026-10-18 Threatist record created from CVE-2026-112017
2026-10-18 Alias added: GHSA-j5cg-5m27-jqf8
2026-10-19 CISA SSVC decision points changed
2026-10-19 Priority changed: MEDIUM → LOW

References

Patch 1

https://github.com/jeecgboot/JeecgBoot/commit/a2be896f753936956ee6863b632b8e5a0231345c

Other 4

TI-2023-20232 jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title… CVSS 3.1CRITICAL 9.8
TI-2025-41083 JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing… CVSS 3.1CRITICAL 9.8
TI-2024-32354 JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the… CVSS 3.1CRITICAL 9.8
TI-2023-22545 Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the… CVSS 3.1CRITICAL 9.8
TI-2023-22016 SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to… CVSS 3.1CRITICAL 9.8
TI-2023-17367 jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the… CVSS 3.1CRITICAL 9.8

See all 179 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences