Threat database

JHipster generator-jhipster versions from 7.0.0 up to but not including 9.4.0 contain an SQL injection vulnerability in reactive applications using Spring WebFlux, Spring Data R2DBC, and SQL databases. The vulnerability arises because attacker-controlled sort parameters are passed into SQL ORDER BY clauses without validation or quoting, allowing execution of additional SQL statements. This can enable an authenticated user to read sensitive data, modify or delete data, or drop tables. The issue is fixed in version 9.4.0.

CVE-2026-107303 is a cross-site scripting (XSS) vulnerability in the JHipster generator-jhipster and react-jhipster components prior to versions 9.4.0 and 1.1.0 respectively. The vulnerability allows an authenticated user with write access to store malicious Blob data that can execute active HTML or SVG content under the application origin when accessed by a privileged user. This issue arises from improper neutralization of input during web page generation and depends on the generated application's content security policy and browser Blob behavior. The vulnerability is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.