# CVE-2026-107375: JHipster SQL injection in sort parameter of generated reactive applications

Source: https://junglewise.ai/threats/cve-2026-107375-jhipster-sql-injection-in-the-parameter-of-jhipster-generated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107375 · Severity: high · CVSS 8.8 · Published 2026-10-08

JHipster is a code generator for Spring Boot web applications. Applications generated with the reactive (WebFlux + R2DBC) option contain an SQL injection vulnerability in the entity list API's sort parameter. An authenticated user with minimal privileges can execute arbitrary SQL commands, potentially exposing password hashes, modifying data, or dropping tables.

Technologies: [generator-jhipster (npm)](https://junglewise.ai/threats/technologies/generator-jhipster). Vendors: [JHipster](https://junglewise.ai/threats/vendors/jhipster), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-107375 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107375 being exploited in the wild.

**How severe is CVE-2026-107375?** High severity, with a CVSS score of 8.8, published 8 October 2026.

**Which products and versions are affected?** JHipster Generator-Jhipster 7.0.0 through 9.2.0; generator-jhipster (npm) >= 7.0.0, < 9.4.0, SEMVER:introduced=7.0.0,fixed=9.4.0.

**Is there a fix for CVE-2026-107375?** Yes. generator-jhipster (npm): upgrade to 9.4.0 or later. Until then: Regenerate affected applications after upgrading the JHipster generator to a patched version. Until then, restrict API access to the entity list endpoints or disable pagination on reactive entities. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107375 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107375?** Check whether you run JHipster Generator-Jhipster or generator-jhipster (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- generator-jhipster (npm): upgrade to 9.4.0 or later

  ```sh
  npm install generator-jhipster@9.4.0
  ```


Regenerate affected applications after upgrading the JHipster generator to a patched version. Until then, restrict API access to the entity list endpoints or disable pagination on reactive entities.

## Technical details

The vulnerability exists in the generated EntityManager_reactive.java template, which concatenates user-supplied sort property names directly into SQL ORDER BY clauses without validation or quoting. R2DBC's simple query protocol executes unparameterized SQL, allowing semicolon-separated statements to execute. The issue affects only reactive (Spring Data R2DBC) paths; JPA (non-reactive) applications are unaffected because Spring Data JPA validates sort properties against the entity metamodel.

## Affected products

- JHipster generator-jhipster 7.0.0 through 9.2.0

## Identifiers

- CVE-2026-107375
- GHSA-r223-96jv-q533

## Timeline

- 2026-10-08: disclosed: GHSA-r223-96jv-q533 published
- 2026-08-29: reported

## Related threats

- [JHipster generated applications stored XSS via unrestricted Blob content type](https://junglewise.ai/threats/cve-2026-107303-jhipster-generated-applications-allow-stored-xss-via)
- [JHipster privilege escalation via response manipulation](https://junglewise.ai/threats/cve-2025-43712-jhipster-privilege-escalation-via-response-manipulation)
- [JHipster generator-jhipster timing attack in token validation](https://junglewise.ai/threats/cve-2015-20110-jhipster-generator-jhipster-timing-attack-in-token-validation)
- [JHipster SQL injection in reactive SQL backend entity repositories](https://junglewise.ai/threats/cve-2022-24815-jhipster-sql-injection-in-reactive-sql-backend-entity)
- [JHipster generator HTTP repository configuration in generated code](https://junglewise.ai/threats/jhipster-generator-http-repository-configuration-in-generated-code-0c7c6095)