Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
SQL Injection in the sort Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applications - Product: jhipster/generator-jhipster (npm package generator-jhipster) - Affected versions: v7.0.0 through v9.2.0 - Component: generated reactive-application code, template EntityManagerreactive.java.ejs - Report date: 2026-08-29 --- 1. Summary Every reactive (Spring WebFlux + Spring Data R2DBC + SQL) application generated by generator-jhipster contains an SQL injection in the paginated entity list endpoints (GET /api/<entity?sort=...). The sort request parameter is taken verbatim from the user and concatenated into the SQL ORDER BY clause without quoting or validation. Because the generated query has no bound parameters, the R2DBC drivers execute it via the simple query protocol, so ;-separated extra statements are run against the database. A single authenticated low-privileged user (including an account obtained through the default self-registration flow) can therefore execute…
Recommended action: Upgrade to 9.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Applications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated openFile helper creates an object URL from the Blob and opens it in a new window. For Blob-bearing entities writable by normal authenticated users, this creates a stored XSS chain: attacker-controlled Blob content and MIME type are stored through the generated REST API, returned to privileged users, and opened as a same-origin Blob document from the generated Angular/React/Vue UI. Exploitability should be confirmed against the generated app’s CSP and target browsers. Details The root cause is a trust-boundary failure across generated server and client code. The generated entity REST resource accepts request bodies for entity creation and update. Unless an entity-specific authority is configured, the template omits method-level @PreAuthorize, leaving the endpoint available to any…
Recommended action: Upgrade to 9.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.
Recommended action: Upgrade to 2.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications created without "reactive with Spring WebFlux" and applications with NoSQL databases are not affected. If you have generated a microservice Gateway using the affected version, you might be impacted as Gateways are reactive by default. Currently, SQL injection is possible in the findAllBy(Pageable pageable, Criteria criteria) method of an entity repository class generated in these applications as the where clause using Criteria for queries are not sanitized and user input is passed on as it is by the criteria. Impacted applications - Monolith and microservice applications with SQL database and reactive with Spring WebFlux combination (other combinations are not affected and the issue is only present when you generate entities) - Gateway applications with SQL database (issue will appear only when generating…
Recommended action: Upgrade to 7.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Generated code uses repository configuration that downloads over HTTP instead of HTTPS Impact Gradle users were using the http://repo.spring.io/plugins-release repositories in plain HTTP, and not HTTPS, so a man-in-the-middle attack was possible at build time. Patches Maven users should at least upgrade to 6.3.0 while Gradle users should update to 6.3.1. If you are not able to upgrade make sure not to use a Maven repository via http in your build file. Workarounds Replace all custom repository definitions in build.gradle or pom.xml with their https version. e.g. References https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/ For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/jhipster/generator-jhipster/issues
Recommended action: Upgrade to 6.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.