AIKIDO-2026-560146
spring-data-jpa is vulnerable to SQL Injection
48
Medium Risk
This Affects:
spring-data-jpaTL;DR
spring-data-jpa Sort validation can be bypassed when crafted sort parameters are accepted from untrusted input and passed into native SQL repository methods. Affected methods are those annotated with @NativeQuery or @Query(nativeQuery=true) that also take a Sort or Pageable argument. On databases that accept non-ASCII characters in SQL syntax, an attacker can use deterministic sorting to infer data characteristics. The patch rejects crafted sort expressions before they reach native SQL.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application accepts Sort parameters from untrusted input for native SQL repository methods.
Background info
spring-data-jpa is vulnerable to SQL Injection in versions 3.0.0 - 4.0.6 and 4.1.0 - 4.1.0.
How to fix this
Upgrade the org.springframework.data:spring-data-jpa library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant