CVE-2026-107375

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated entity-list endpoints into createOrderByFields in generators/spring-boot/generators/data-relational/templates/src/main/java/package/repository/EntityManager_reactive.java.ejs. The generated code renders these properties into the SQL ORDER BY clause without validation or quoting, and the R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can consequently read sensitive tables, modify or delete data, or drop tables, while non-reactive JPA applications and NoSQL backends are outside this root cause. This issue is fixed in 9.4.0.

• CWE-89

• https://github.com/jhipster/generator-jhipster/commit/f6f1579581da8db0d1b8bd28dd473b56951c83af
• https://github.com/jhipster/generator-jhipster/releases/tag/v9.4.0
• https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-r223-96jv-q533

Published

Oct 8, 2026

Last Modified

Oct 9, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107355Rejected reason: ** This candidate has been removed by an or…
• CVE-2026-10736The Tutor LMS – eLearning and online course solution plugin …4.9
• CVE-2026-107361The Arkime live capture service (arkime-live) in Malcolm run…4.2
• CVE-2026-107362Malcolm file-upload component ships the upstream FilePond PH…7.1
• CVE-2026-107363In OpenStack Zaqar before 23.0.1, the WebSocket transport fa…6.1
• CVE-2026-10737The SP Project & Document Manager plugin for WordPress is vu…7.5
• CVE-2026-107376webonyx graphql-php is a PHP implementation of the GraphQL s…8.2
• CVE-2026-107377datamodel-code-generator generates Python data models from s…7.5
• CVE-2026-107378CairoSVG is an SVG converter based on Cairo, a 2D graphics l…8.7
• CVE-2026-107379savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, s…6.5
• CVE-2026-10738The jQuery Hover Footnotes plugin for WordPress is vulnerabl…6.4
• CVE-2026-107380savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, s…5.4