JHipster Generator CVE-2026-107375

Exploitable only when the JHipster-generated application is a reactive stack built with Spring WebFlux, Spring Data R2DBC, and a SQL database (reproduced on H2 and PostgreSQL 16); the attacker must reach a paginated entity-list endpoint (GET /api/<entity>?sort=...) and hold an authenticated account, though the default self-registration flow lets a low-privileged account be self-provisioned. Limiting factors: non-reactive Spring Data JPA applications are NOT affected because JPA validates sort property names against the entity metamodel, and NoSQL backends are outside the root cause; exploitation therefore depends specifically on the reactive R2DBC code path generated by versions 7.0.0 up to 9.4.0.

Multiple signals point to a genuine priority rather than an inflated CVSS score. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full confidentiality/integrity/availability impact - consistent with CWE-89 SQL injection that permits stacked statements via the R2DBC simple query protocol. The GHSA advisory confirms the authenticated-user requirement is weak because the default JHipster self-registration flow lets an attacker provision their own low-privilege account, effectively lowering the barrier toward unauthenticated-equivalent exposure for any app with registration enabled. The advisory also reports the issue was independently reproduced end-to-end on both the default dev database (H2) and default production database (PostgreSQL 16), strengthening confidence that exploitation is practical, not theoretical. Countervailing/missing signals: no EPSS score was provided, so statistical exploitation probability cannot be stated; there is no CISA KEV listing, so this is not confirmed as actively exploited; and no standalone public exploit tool is referenced - though the advisory publishes the vulnerable code path and payload mechanics in enough detail to materially aid exploit development. Net: treat as a high-priority patch item for any team running JHipster-generated reactive (WebFlux + R2DBC + SQL) applications, while recognizing the scope limitation that non-reactive JPA and NoSQL deployments are not affected.

An attacker registers a normal low-privileged account (or uses an existing one) on a JHipster-generated reactive WebFlux/R2DBC application, then issues a GET request to a paginated entity-list endpoint such as /api/<entity> with a crafted sort parameter. Because the value is concatenated unquoted into the ORDER BY clause and run over the R2DBC simple query protocol, the attacker appends semicolon-separated statements to dump the jhi_user password-hash table, alter/delete rows, or drop tables. No public exploit tool is identified, but the advisory documents the vulnerable template and injection mechanics in reproducible detail.