CVE-2026-111390 json
Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API
published 24d ago modified 19d ago also EUVD-2026-102844
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.
Is CVE-2026-111390 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20d ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- hackmd.io https://hackmd.io/m0EK1XcGQfua6QHIXXNqMQ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- erupts erupt
Classification
- Weakness
-
- CWE-564 Use of Hibernate with HQL/SQL Query String Containing External Input
References
-
hackmd.io
/m0EK1XcGQfua6QHIXXNqMQ
third-party-advisory, exploit
-
github.com
/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/service/EruptService.java#L62-L71
technical-description
-
github.com
/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/util/TypeUtil.java#L107-L115
technical-description
-
github.com
/erupts/erupt/blob/2.3.0/erupt-data/erupt-data-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java#L210-L21
technical-description
-
github.com
/erupts/erupt
product
-
vulncheck.com
/advisories/erupt-through-2.3.0-hql-injection-via-linktreeval-in-data-table-api
third-party-advisory
Sources
- CVE List CVE-2026-111390
- NVD CVE-2026-111390
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.