CVE-2026-107375: SQL Injection in JHipster-Generated Reactive Applications
Summary
CVE-2026-107375: SQL Injection in the sort Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applications - Product: jhipster/generator-jhipster (npm package generator-jhipster) - Affected versions: v7.0.0 through v9.2.0 - Compo... Affects generator-jhipster versions >= 7.0.0, < 9.4.0. Fixed in 9.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JHipster is a development platform that allows developers to generate, develop, and deploy Spring Boot + Angular/React/Vue web applications and Spring microservices. The generator-jhipster package is an npm package that provides templates and tools for creating JHipster applications. This package has a vulnerability that affects versions v7.0.0 through v9.2.0, specifically in the generated code for reactive applications using Spring WebFlux and R2DBC.
Vulnerability Detail
The vulnerability is an SQL injection flaw found in the 'sort' parameter of paginated entity list endpoints in JHipster-generated reactive applications. The 'sort' parameter is directly concatenated into the SQL 'ORDER BY' clause without proper validation or quoting. This allows an attacker, even with low privileges, to execute arbitrary SQL commands, leading to potential data breaches, data modification, or even deletion of database tables. The vulnerability arises from the generator template that fails to validate user input before using it in SQL queries.
How To Fix
Latest published version: 9.4.0 as of 23 Oct 2026
npm install generator-jhipster@9.4.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate the 'sort' parameter in your application code before it is passed to the SQL query. Ensure that only expected column names are allowed and reject any input that does not match these criteria.
Conclusion
The SQL injection vulnerability in JHipster-generated reactive applications poses a significant risk to data integrity and confidentiality. It is crucial for developers using affected versions of the generator-jhipster package to update to the patched version or implement workarounds to safeguard their applications.
See every vulnerability recorded for generator-jhipster →
FAQ
The vulnerability allows attackers to execute arbitrary SQL commands, which can lead to unauthorized data access, data modification, or deletion of database tables.
Any applications generated using the generator-jhipster package versions v7.0.0 through v9.2.0 that utilize reactive programming with Spring WebFlux and R2DBC are affected.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your package-lock.json file, you can receive real-time alerts. You can also check your application using the Vulert playground without any signup.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
If immediate updates are not possible, implement input validation for the 'sort' parameter in your application to mitigate the risk of SQL injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for generator-jhipster.
