A developed JHipster reactive application may allow an attacker to inject arbitrary SQL through the sort request parameter used in paginated entity-list endpoints. The generator emits code that transmits this raw parameter into an ORDER BY clause without validation or quoting, thereby permitting the injection of additional SQL statements via semicolons. This flaw enables an authenticated user to read, modify, delete, or drop database tables, compromising data confidentiality and integrity.

Any application produced by the JHipster generator version 7.0.0 through 9.3.x that uses Spring WebFlux, Spring Data R2DBC, and a SQL database is affected. Non‑reactive JPA applications and those with NoSQL backends are not impacted.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is currently unavailable, and the flaw is not listed in the CISA KEV catalog. Attack requires only authentication and simple manipulation of the sort parameter, making exploitation straightforward. Because the flaw is present in a large generation model, widespread deployment of vulnerable versions raises the likelihood of exploitation.