Is CVE-2026-107375 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107375 being exploited in the wild.

How severe is CVE-2026-107375?

High severity, with a CVSS score of 8.8, published 8 October 2026.

Which products and versions are affected?

JHipster Generator-Jhipster 7.0.0 through 9.2.0; generator-jhipster (npm) >= 7.0.0, < 9.4.0, SEMVER:introduced=7.0.0,fixed=9.4.0.

How is CVE-2026-107375 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107375?

Check whether you run JHipster Generator-Jhipster or generator-jhipster (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107375: JHipster SQL injection in sort parameter of generated reactive applications

Q: Is there a fix for CVE-2026-107375?

Yes. generator-jhipster (npm): upgrade to 9.4.0 or later. Until then: Regenerate affected applications after upgrading the JHipster generator to a patched version. Until then, restrict API access to the entity list endpoints or disable pagination on reactive entities. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107375 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-107375?

Check whether you run JHipster Generator-Jhipster or generator-jhipster (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107375 · Severity: high · CVSS 8.8 · Published 2026-10-08

JHipster is a code generator for Spring Boot web applications. Applications generated with the reactive (WebFlux + R2DBC) option contain an SQL injection vulnerability in the entity list API's sort parameter. An authenticated user with minimal privileges can execute arbitrary SQL commands, potentially exposing password hashes, modifying data, or dropping tables.

Technologies: generator-jhipster (npm). Vendors: JHipster, npm.

Quick answers

Is CVE-2026-107375 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107375 being exploited in the wild.
How severe is CVE-2026-107375?: High severity, with a CVSS score of 8.8, published 8 October 2026.
Which products and versions are affected?: JHipster Generator-Jhipster 7.0.0 through 9.2.0; generator-jhipster (npm) >= 7.0.0, < 9.4.0, SEMVER:introduced=7.0.0,fixed=9.4.0.
Is there a fix for CVE-2026-107375?: Yes. generator-jhipster (npm): upgrade to 9.4.0 or later. Until then: Regenerate affected applications after upgrading the JHipster generator to a patched version. Until then, restrict API access to the entity list endpoints or disable pagination on reactive entities. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107375 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107375?: Check whether you run JHipster Generator-Jhipster or generator-jhipster (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

generator-jhipster (npm): upgrade to 9.4.0 or later
```
npm install generator-jhipster@9.4.0
```

Regenerate affected applications after upgrading the JHipster generator to a patched version. Until then, restrict API access to the entity list endpoints or disable pagination on reactive entities.

Technical details

The vulnerability exists in the generated EntityManager_reactive.java template, which concatenates user-supplied sort property names directly into SQL ORDER BY clauses without validation or quoting. R2DBC's simple query protocol executes unparameterized SQL, allowing semicolon-separated statements to execute. The issue affects only reactive (Spring Data R2DBC) paths; JPA (non-reactive) applications are unaffected because Spring Data JPA validates sort properties against the entity metamodel.

Affected products

JHipster generator-jhipster 7.0.0 through 9.2.0

Identifiers

CVE-2026-107375
GHSA-r223-96jv-q533

Timeline

2026-10-08: disclosed: GHSA-r223-96jv-q533 published
2026-08-29: reported

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.