CVE-2025-31119

Deeper analysis

generator-jhipster-entity-audit is a JHipster module that adds entity audit support and an audit log page. Prior to version 5.9.1, the module contains an unsafe reflection flaw when the Javers Entity Audit Framework is selected. The issue stems from code paths in JaversEntityAuditResource that accept attacker-controlled input to resolve and invoke classes, enabling remote code execution if malicious classes are present on the classpath.

An attacker must first place malicious classes on the classpath and then obtain access to the exposed REST endpoints. With those conditions met, crafted requests to the affected endpoints can trigger arbitrary class loading and method invocation, resulting in full remote code execution under the privileges of the application process.

The project security advisory GHSA-7rmp-3g9f-cvq8 and the accompanying patch release state that the vulnerability is fixed in generator-jhipster-entity-audit 5.9.1. Users are advised to upgrade immediately and to verify that only trusted classes reside on the application classpath.

EPSS for the CVE rose from a low baseline to a recorded peak of 0.0375, indicating that exploitation interest increased after public disclosure.