GHSA-mc84-xr9p-938r — High severity vulnerability that affects generator-jhipster

2026-10-17T09:43:19.635638+00:00

Affected: npm: generator-jhipster

## Generated code uses repository configuration that downloads over HTTP instead of HTTPS

### Impact Gradle users were using the http://repo.spring.io/plugins-release repositories in plain HTTP, and not HTTPS, so a man-in-the-middle attack was possible at build time.

### Patches

Maven users should at least upgrade to 6.3.0 while Gradle users should update to 6.3.1. If you are not able to upgrade make sure not to use a Maven repository via `http` in your build file.

### Workarounds

Replace all custom repository definitions in `build.gradle` or `pom.xml` with their `https` version.

e.g.

```xml oss.sonatype.org-snapshot https://oss.sonatype.org/content/repositories/snapshots // <-- must be httpS false true ```

```gradle maven { url "https://repo.spring.io/plugins-release" } // <-- must be httpS ```

### References * https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/

### For more information If you have any questions or comments about this advisory: * Open an issue in [https://github.com/jhipster/generator-jhipster/issues](https://github.com/jhipster/generator-jhipster/issues)

Most recent entries from all

GHSA-mc84-xr9p-938r — High severity vulnerability that affects generator-jhipster