JHipster generator-jhipster: SQL injection via sort parameter in reactive apps
Summary
The JHipster generator creates reactive web applications with Spring WebFlux, Spring Data R2DBC and a SQL database. In affected versions, the generated code passes the attacker-controlled sort parameter of paginated list endpoints unvalidated and unquoted into the SQL ORDER BY clause, and the R2DBC simple query protocol accepts multiple statements separated by semicolons. An authenticated low-privileged user, including one who registers through default self-registration, can read sensitive tables (including password hashes), modify or delete data, or drop tables. Non-reactive JPA applications and NoSQL backends are not affected by this root cause.
Affected
- Applications generated by generator-jhipster from 7.0.0 up to 9.4.0 (Spring WebFlux, Spring Data R2DBC, SQL database)
- Sources disagree on the range: the primary advisory states 7.0.0 to before 9.4.0; Mend lists 9.0.0 to 9.4.0; PT-2026-108672 lists 7.0.0 to 9.2.0. Treat 7.0.0 to 9.3.x as affected until verified.
Fixed in
- Generator version 9.4.0 (fix commit f6f1579581da8db0d1b8bd28dd473b56951c83af)
- Existing projects are not fixed by upgrading the generator alone: the generated code must be regenerated or manually corrected.
Workaround
Unknown.
- No vendor-documented workaround has been identified.
- Measures such as allow-listing sort values, restricting database account privileges or blocking stacked statements have not been verified and must be checked by a developer.
Exploitation
- In the wild: no evidence found; the CISA SSVC assessment lists exploitation as none and automatable as no. KEV status was not verified directly.
- Public reproduction material exists in the GitHub advisory, so exploitation requires only low effort once an account is available.
- EPSS: 0.00341 (Tenable).
Our recommendation
- Identify all JHipster-generated applications and their generator version (.yo-rc.json or jhipsterConfig).
- Check whether any use Spring WebFlux with R2DBC and a SQL database.
- Prioritise internet-exposed applications, especially those with self-registration enabled.
- Regenerate or patch affected applications against 9.4.0 and redeploy.
- Review database logs and table integrity since exposure, given the described read and write impact.
- Rotate credentials of users and database accounts if compromise cannot be excluded.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-r223-96jv-q533 github.com
- Fix commit f6f1579 (generator-jhipster) github.com
- Release v9.4.0 (generator-jhipster) github.com
- JHipster release 9.4.0 announcement www.jhipster.tech
- OSV advisory GHSA-r223-96jv-q533 osv.dev
- GitLab advisory CVE-2026-107375 (npm generator-jhipster) advisories.gitlab.com
- Tenable CVE-2026-107375 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:12.
Original description (NVD)
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated entity-list endpoints into createOrderByFields in generators/spring-boot/generators/data-relational/templates/src/main/java/package/repository/EntityManager_reactive.java.ejs. The generated code renders these properties into the SQL ORDER BY clause without validation or quoting, and the R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can consequently read sensitive tables, modify or delete data, or drop tables, while non-reactive JPA applications and NoSQL backends are outside this root cause. This issue is fixed in 9.4.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.