CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework

published 2025-04-03 19 mo ago modified 2026-06-17 4 mo ago also GHSA-7rmp-3g9f-cvq8 , EUVD-2025-9738

cvss: 7.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath and also has access to these REST interface for calling the mentioned REST endpoints, using these lines of code can lead to unintended remote code execution. This vulnerability is fixed in 5.9.1.

Patch / fix

fixed in 1

npm generator-jhipster-entity-audit 5.9.1

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 19 mo ago (2025-04-03)

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.7	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
GitHub	3.1	7.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	generator-jhipster-entity-audit	<5.9.1	5.9.1

Affected products

jhipster generator-jhipster-entity-audit

Classification

Weakness

CWE-470 Use of Externally-Controlled Input to Select Classes or Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary