CVE-2026-107375— JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
Quick assessment
Affected
jhipster generator-jhipster
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
JHipster 是一个开发平台，用于快速生成、开发和部署现代 Web 应用程序和微服务架构。在版本 7.0.0 至 9.4.0 之间，使用 Spring WebFlux、Spring Data R2DBC 和 SQL 数据库生成的响应式应用程序，会将攻击者控制的排序请求参数从分页实体列表端点传递到 中的 方法。生成的代码将这些属性直接渲染到 SQL ORDER BY 子句中，未进行任何验证或转义处理，而 R2DBC 简单查询协议允许执行由分号分隔的额外语句。因此，普通已认证用户可能读取敏感数据表、修改或删除数据，
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jhipster | generator-jhipster | >= 7.0.0, < 9.4.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107375
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
Source: CVE Program / CVE List V5
Vulnerability Description
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated entity-list endpoints into createOrderByFields in generators/spring-boot/generators/data-relational/templates/src/main/java/package/repository/EntityManager_reactive.java.ejs. The generated code renders these properties into the SQL ORDER BY clause without validation or quoting, and the R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can consequently read sensitive tables, modify or delete data, or drop tables, while non-reactive JPA applications and NoSQL backends are outside this root cause. This issue is fixed in 9.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| jhipster | generator-jhipster | >= 7.0.0, < 9.4.0 | - |
|
II. Public POCs for CVE-2026-107375
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107375
请登录查看更多情报信息。
Other References for CVE-2026-107375 (3)
-
https://github.com/jhipster/generator-jhipster/releases/tag/v9.4.0 x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: jhipster
-
CVE-2026-107303
JHipster: Generated Applications Allow Stored XSS via Unrest -
CVE-2025-43712
JHipster 安全漏洞 -
CVE-2025-31119
CWE-470 in generator-jhipster-entity-audit when having Javer -
CVE-2022-24815
SQL Injection when creating an application with Reactive SQL -
CVE-2020-4072
Log Forging in generator-jhipster-kotlin
Same weakness: CWE-89
-
CVE-2025-71428
Jivejdon through 5.0 SQL Injection via username in userListA -
CVE-2026-80381
Multiple vulnerabilities affect the Sniffer component as par -
CVE-2026-81932
Multiple vulnerabilities affect the Sniffer component as par -
CVE-2026-84209
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-16830
Security vulnerabilities have been found in IBM Verify Ident
V. Comments for CVE-2026-107375
No comments yet