@joaopaulomfe/generator-jhipster-agile-kip (>=0.1.0, <=0.1.1), dsi-nodejs-generator (3.0.0) +72 more potentially affected by CVE-2026-107375 via generator-jhipster (>=7.0.0, <=9.2.0)

generator-jhipster NPM version =7.0.0, =0.1.0, =0.0.11, =2.0.17, =0.0.0, =0.0.1, =0.0.78 and more Source cves: CVE-2026-107375 Source advisory: GHSA-R223-96JV-Q533...

@joaopaulomfe/generator-jhipster-agile-kip (>=0.1.0, <=0.1.1), dsi-nodejs-generator (3.0.0) +72 more potentially affected by CVE-2026-107375 via generator-jhipster (>=7.0.0, <=9.2.0)

generator-jhipster NPM version =7.0.0, =0.1.0, =0.0.11, =2.0.17, =0.0.0, =0.0.1, =0.0.78 and more Source cves: CVE-2026-107375 Source advisory: OSV:GHSA-R223-96JV-Q533...

JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

SQL Injection in the sort Parameter of JHipster-Generated Reactive WebFlux + R2DBC Applications - Product: jhipster/generator-jhipster npm package generator-jhipster - Affected versions: v7.0.0 through v9.2.0 - Component: generated reactive-application code, template EntityManagerreactive.java.ej...

GHSA-R223-96JV-Q533 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

SQL Injection in the sort Parameter of JHipster-Generated Reactive WebFlux + R2DBC Applications - Product: jhipster/generator-jhipster npm package generator-jhipster - Affected versions: v7.0.0 through v9.2.0 - Component: generated reactive-application code, template EntityManagerreactive.java.ej...

JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

Summary Applications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated openFile helper creates an object URL from the Blob and opens it in a new window. For...

generator-jhipster-ai-postgresql (>=2.0.17, <=2.0.31), generator-jhipster-cassandra (>=1.0.15, <=1.0.28) +14 more potentially affected by CVE-2026-107303 via generator-jhipster (>=9.0.0-beta.3, <=9.2.0)

generator-jhipster NPM version =9.0.0-beta.3, =2.0.17, =1.0.15, =2.1.2, =6.0.0, =4.0.0, =1.0.2, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =2.0.1 and more Source cves: CVE-2026-107303 Source advisory: OSV:GHSA-9FFP-22J7-56R2...

generator-jhipster-ai-postgresql (>=2.0.17, <=2.0.31), generator-jhipster-cassandra (>=1.0.15, <=1.0.28) +14 more potentially affected by CVE-2026-107303 via generator-jhipster (>=9.0.0-beta.3, <=9.2.0)

generator-jhipster NPM version =9.0.0-beta.3, =2.0.17, =1.0.15, =2.1.2, =6.0.0, =4.0.0, =1.0.2, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =2.0.1 and more Source cves: CVE-2026-107303 Source advisory: GHSA-9FFP-22J7-56R2...

NPM: JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

NPM: JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob vulnerability discovered by ? in WordPress Npm generator-jhipster versions 9.4.0...

generator-jhipster-ai-postgresql (>=2.0.17, <=2.0.31), generator-jhipster-cassandra (>=1.0.15, <=1.0.28) +14 more potentially affected by CVE-2026-107375 via generator-jhipster (>=9.0.0, <=9.2.0)

generator-jhipster NPM version =9.0.0, =2.0.17, =1.0.15, =2.1.2, =6.1.0, =4.0.0, =1.0.2, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-107375 Source advisory: MEND:CVE-2026-107375...

generator-jhipster-ai-postgresql (>=2.0.17, <=2.0.31), generator-jhipster-cassandra (>=1.0.15, <=1.0.28) +14 more potentially affected by CVE-2026-107303 via generator-jhipster (>=9.0.0, <=9.2.0)

generator-jhipster NPM version =9.0.0, =2.0.17, =1.0.15, =2.1.2, =6.1.0, =4.0.0, =1.0.2, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-107303 Source advisory: MEND:CVE-2026-107303...

PT-2026-108100

Name of the Vulnerable Software and Affected Versions generator-jhipster versions prior to 9.4.0 react-jhipster versions prior to 1.1.0 Description Applications generated by the platform can persist attacker-controlled Blob data and companion ContentType values, which are then returned through...

PT-2026-108672

SQL Injection in the sort Parameter of JHipster-Generated Reactive WebFlux + R2DBC Applications - Product: jhipster/generator-jhipster npm package generator-jhipster - Affected versions: v7.0.0 through v9.2.0 - Component: generated reactive-application code, template EntityManager reactive.java.e...

PT-2026-108643

Summary Applications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated openFile helper creates an object URL from the Blob and opens it in a new window. For...

WS-2019-0360

Generator-jhipster before 6.3.1 is vulnerable against man-in-the-middle attack due to an issue related to repositories operating over plain HTTP...

EUVD-2020-0506

Malware in sbrugna...

Incorrect Authorization

Overview generator-jhipster is a development platform to generate, develop and deploy Spring Boot + Angular / React / Vue Web applications and Spring microservices. Affected versions of this package are vulnerable to Incorrect Authorization via the authorities parameter in the response from the...

@iurra/chickpea-stew (>=0.3.0, <=0.3.7), @joaopaulomfe/generator-jhipster-agile-kip (>=0.1.0, <=0.1.1) +175 more potentially affected by CVE-2025-43712 via generator-jhipster (>=2.25.0, <=9.4.0)

generator-jhipster NPM version =2.25.0, =0.3.0, =0.1.0, =0.0.3, =0.0.11, =2.0.13, =0.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2 - generator-jhipster-angulardemo 0.0.0 and more Source cves: CVE-2025-43712 Source advisory: SNYK:JS-GENERATORJHIPSTER-11023283...

Remote Code Execution (RCE)

generator-jhipster-entity-audit is vulnerable to Remote Code Execution RCE. The vulnerability is due to unsafe reflection caused by using Javers as the Entity Audit Framework, which allows malicious classes on the classpath to be exploited through exposed REST endpoints...

CVE-2025-31119

generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath...

CVE-2025-31119 CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework

generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath...