CVE-2025-31119
CVE-2025-31119 is a high-severity vulnerability with a CVSS 3.x base score of 7.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-470.
Key facts
- Severity: High (CVSS 3.x base score 7.6)
- EPSS exploit prediction: 0% (39th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-9738
- Weakness: CWE-470
- Published:
- Last modified:
Description
generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath and also has access to these REST interface for calling the mentioned REST endpoints, using these lines of code can lead to unintended remote code execution. This vulnerability is fixed in 5.9.1.
Frequently asked questions
- What is CVE-2025-31119?
- generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath and also has access to these REST interface for calling the mentioned REST endpoints, using these lines of code can lead to unintended remote code execution. This vulnerability is fixed in 5.9.1.
- How severe is CVE-2025-31119?
- CVE-2025-31119 has a CVSS 3.x base score of 7.6, rated high severity. It is exploitable over network with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2025-31119 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (39th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-31119?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2025-31119 have an EU (EUVD) identifier?
- Yes. CVE-2025-31119 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-9738.
- When was CVE-2025-31119 published?
- CVE-2025-31119 was published on 2025-04-03 and last updated on 2026-06-17.
References
- https://github.com/jhipster/generator-jhipster-entity-audit/blob/e21e83135d10c77d92203c89cb0b0063914e8fe0/generators/spring-boot-javers/templates/src/main/java/_package_/web/rest/JaversEntityAuditResource.java.ejs#L88
- https://github.com/jhipster/generator-jhipster-entity-audit/security/advisories/GHSA-7rmp-3g9f-cvq8
Other CWE-470 (Unsafe Reflection) vulnerabilities
- CVE-2026-42027 — Critical (CVSS 9.8): Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before…
- CVE-2025-34393 — Critical (CVSS 9.8): Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify…
- CVE-2025-53693 — Critical (CVSS 9.8): Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore…
- CVE-2023-6943 — Critical (CVSS 9.8): Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric…
- CVE-2021-31522 — Critical (CVSS 9.8): Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version…
- CVE-2019-1003041 — Critical (CVSS 9.8): A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary…