CVE-2022-24815: SQL Injection in generator-jhipster
Summary
CVE-2022-24815: SQL Injection when creating an application with Reactive SQL backend. Affects generator-jhipster versions >= 7.0.0, < 7.8.1. Fixed in 7.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
generator-jhipster is an open-source development platform for generating, developing, and deploying Spring Boot + Angular/React/Vue web applications and Spring microservices. It provides a powerful command-line interface (CLI) for creating projects, entities, and other components. The vulnerability affects applications generated with the option 'reactive with Spring WebFlux' enabled and an SQL database using r2dbc. It allows for SQL injection in the 'findAllBy(Pageable pageable, Criteria criteria)' method of entity repository classes, where user input is not properly sanitized before being used in the query.
Vulnerability Detail
The SQL injection vulnerability in generator-jhipster allows an attacker to manipulate the criteria used in the 'findAllBy' method of entity repository classes. This can lead to unauthorized access, data leakage, or even complete database compromise. The vulnerability is present in applications generated with the 'reactive with Spring WebFlux' option enabled and an SQL database using r2dbc. Applications without this combination or with NoSQL databases are not affected. The vulnerability has been assigned a CVSS score of 8.1, indicating a high severity level.
How To Fix
Latest published version: 9.4.0 as of 23 Oct 2026
npm install generator-jhipster@9.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.8.1
This is the first release that contains the fix.
npm install generator-jhipster@7.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, the possibility to pass user-provided criteria to the 'createSelect' method of 'EntityManager' has been removed. This prevents the SQL injection vulnerability but also removes the ability to perform custom filtering using criteria. It is recommended to update to the patched version instead of relying on workarounds.
Conclusion
The SQL injection vulnerability in generator-jhipster can have severe consequences, including unauthorized access, data leakage, and database compromise. It is crucial to update to the patched version (7.8.1) to mitigate the vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for generator-jhipster →
FAQ
Monolith and microservice applications with an SQL database and the 'reactive with Spring WebFlux' combination are affected. Applications without this combination or with NoSQL databases are not affected.
Yes, Gateway applications with an SQL database are affected. However, the vulnerability only appears when generating entities.
The SQL injection vulnerability allows for unauthorized access, data leakage, or complete compromise of the database. It can be exploited to execute arbitrary SQL queries and potentially manipulate or extract sensitive data.
Yes, the vulnerability has been patched in version 7.8.1 of generator-jhipster.
No, the patch removes the ability to do custom filtering using criteria in the generated applications. It is recommended to update to the patched version and find alternative approaches for custom filtering if needed.
References
Related vulnerabilities
Recent vulnerabilities recorded for generator-jhipster.
