CVE-2026-107375

HighCVSS 8.8

Published: 08/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

JHipster from 7.0.0 until 9.4.0 has a vulnerability in generated reactive applications (Spring WebFlux, Spring Data R2DBC, SQL). The attacker-controlled sort request parameter is passed into createOrderByFields in EntityManager_reactive.java.ejs, and rendered into the SQL ORDER BY clause without validation or quoting. The R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can read sensitive tables, modify or delete data, or drop tables.

Risk Assessment

An attacker can gain unauthorized access to data, modify or delete it, posing a serious risk to integrity and confidentiality.

Recommendation

It is recommended to upgrade JHipster to version 9.4.0 or later.

Other vulnerabilities in JHipster

CVE-2026-107303High
JHipster prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0 has a vulnerability where generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through REST endpoints, and pass them to the generated openFile helper. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it.

Original NVD description (English source)

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated entity-list endpoints into createOrderByFields in generators/spring-boot/generators/data-relational/templates/src/main/java/package/repository/EntityManager_reactive.java.ejs. The generated code renders these properties into the SQL ORDER BY clause without validation or quoting, and the R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can consequently read sensitive tables, modify or delete data, or drop tables, while non-reactive JPA applications and NoSQL backends are outside this root cause. This issue is fixed in 9.4.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS