JHipster Fixes SQL Injection in Reactive Apps Generated via R2DBC

JHipster has released version 9.4.0 to address a high-severity SQL injection vulnerability in applications generated by its development platform. The flaw, tracked as CVE-2026-107375, allows authenticated users to execute arbitrary SQL commands in reactive applications that utilize Spring WebFlux and Spring Data R2DBC with SQL backends.

The vulnerability stems from how the `generator-jhipster` npm package constructs database queries for paginated entity-list endpoints. According to the National Vulnerability Database (NVD) and GitHub advisory GHSA-r223-96jv-q533, the generated code passes the attacker-controlled `sort` request parameter directly into the `createOrderByFields` method within the `EntityManager_reactive.java.ejs` template. This process renders the input into the SQL `ORDER BY` clause without validation or quoting. Because the generated queries lack bound parameters, R2DBC drivers execute them via the simple query protocol, which permits the execution of additional statements separated by semicolons.

Context and Background

The issue was reported on August 29, 2026, and affects JHipster generator versions from 7.0.0 up to, but not including, 9.4.0. The NVD assigns the vulnerability a CVSS score of 8.8, classifying it as High severity. The root cause is identified as CWE-89, or SQL Injection.

Researchers noted that the flaw allows a normal authenticated user to read sensitive tables, modify or delete data, or drop tables entirely. The advisory states that the issue was independently reproduced end-to-end on both the default development database (H2) and the default production database (PostgreSQL 16). An attacker with a low-privileged account, including one obtained through the default self-registration flow, can exploit this to access critical data such as password hashes stored in the `jhi_user` table.

Who Is Affected

The vulnerability specifically impacts reactive applications generated by JHipster that use Spring WebFlux, Spring Data R2DBC, and a SQL database. Non-reactive JPA applications are not affected because Spring Data JPA validates sort property names against the entity metamodel. Similarly, NoSQL backends are outside the scope of this root cause, as the injection vector relies on SQL-specific query construction and execution protocols.

The affected component is the `generator-jhipster` npm package. Organizations using JHipster to generate modern web applications and microservice architectures must verify their generator version. Any project generated with versions 7.0.0 through 9.2.0 contains the vulnerable code template.

What should you do?

JHipster has released version 9.4.0, which fixes the issue by adding validation to the sort parameters in the generated code. Users of the `generator-jhipster` npm package should update to version 9.4.0 or later. Existing applications generated with vulnerable versions may require regeneration or manual code review to ensure the `sort` parameter is properly validated and quoted in the `ORDER BY` clause.