High severity vulnerability that affects generator-jhipster
A high severity vulnerability affects generator-jhipster versions from 4.5.2 up to but not including 6.3.1. The issue arises because generated code uses repository configurations that download dependencies over HTTP instead of HTTPS, exposing Gradle users to potential man-in-the-middle attacks during build time. Maven users are advised to upgrade to version 6.3.0 or later, and Gradle users to 6.3.1 or later. Alternatively, users should replace any HTTP repository URLs with HTTPS to mitigate the risk.
AI Analysis
Technical Summary
The vulnerability involves the use of HTTP URLs for Maven or Gradle repositories in generated code by generator-jhipster, specifically the use of http://repo.spring.io/plugins-release instead of HTTPS. This insecure configuration allows an attacker to perform man-in-the-middle attacks during the build process, potentially compromising confidentiality, integrity, and availability of the build artifacts. The vulnerability affects versions >=4.5.2 and <6.3.1. Patches are available in Maven 6.3.0 and Gradle 6.3.1. Users unable to upgrade should ensure all repository URLs use HTTPS.
Potential Impact
An attacker capable of intercepting network traffic could exploit the use of HTTP repository URLs to manipulate or inject malicious code during the build process. This compromises the confidentiality, integrity, and availability of the software build, potentially leading to severe security breaches in the resulting applications.
Mitigation Recommendations
A fix is available: Maven users should upgrade to version 6.3.0 or later, and Gradle users to 6.3.1 or later. If upgrading is not possible, users must replace all HTTP repository URLs in build files (e.g., build.gradle or pom.xml) with their HTTPS equivalents to prevent man-in-the-middle attacks.
High severity vulnerability that affects generator-jhipster
Description
A high severity vulnerability affects generator-jhipster versions from 4.5.2 up to but not including 6.3.1. The issue arises because generated code uses repository configurations that download dependencies over HTTP instead of HTTPS, exposing Gradle users to potential man-in-the-middle attacks during build time. Maven users are advised to upgrade to version 6.3.0 or later, and Gradle users to 6.3.1 or later. Alternatively, users should replace any HTTP repository URLs with HTTPS to mitigate the risk.
CVSS v3.1
Score 8.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability involves the use of HTTP URLs for Maven or Gradle repositories in generated code by generator-jhipster, specifically the use of http://repo.spring.io/plugins-release instead of HTTPS. This insecure configuration allows an attacker to perform man-in-the-middle attacks during the build process, potentially compromising confidentiality, integrity, and availability of the build artifacts. The vulnerability affects versions >=4.5.2 and <6.3.1. Patches are available in Maven 6.3.0 and Gradle 6.3.1. Users unable to upgrade should ensure all repository URLs use HTTPS.
Potential Impact
An attacker capable of intercepting network traffic could exploit the use of HTTP repository URLs to manipulate or inject malicious code during the build process. This compromises the confidentiality, integrity, and availability of the software build, potentially leading to severe security breaches in the resulting applications.
Mitigation Recommendations
A fix is available: Maven users should upgrade to version 6.3.0 or later, and Gradle users to 6.3.1 or later. If upgrading is not possible, users must replace all HTTP repository URLs in build files (e.g., build.gradle or pom.xml) with their HTTPS equivalents to prevent man-in-the-middle attacks.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-jhipster-GHSA-mc84-xr9p-938r
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6aac8e1855bf5e2cf549043e
Added to database: 09/18/2026, 01:04:24 UTC
Last enriched: 09/18/2026, 01:36:21 UTC
Last updated: 09/18/2026, 02:14:09 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.