CVE-2026-111390: Erupt HQL Injection Vulnerability

CVE-2026-111390 Overview

CVE-2026-111390 is an HQL (Hibernate Query Language) injection vulnerability affecting the Erupt low-code framework through version 2.3.0. The flaw resides in the linkTreeVal parameter of the POST /erupt-api/data/table/{erupt} endpoint. Authenticated users with query permission on entities containing String-keyed linkTree targets can inject unescaped quotes to bypass tree-scoped data filters. Successful exploitation allows attackers to append always-true OR clauses or boolean subqueries, enabling unauthorized reads across other mapped entities. The vulnerability is categorized under CWE-564: SQL Injection: Hibernate.

Critical Impact
Authenticated attackers can bypass data scoping controls and read sensitive data from unrelated entities exposed through the Erupt data table API.

Affected Products

Erupt framework versions through 2.3.0
Erupt Core module (erupt-core)
Erupt JPA Data module (erupt-data-jpa)

Discovery Timeline

2026-10-16 - CVE CVE-2026-111390 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-111390

Vulnerability Analysis

Erupt is a Java-based low-code framework that auto-generates admin interfaces from annotated JPA entities. The data table endpoint (/erupt-api/data/table/{erupt}) accepts a linkTreeVal parameter used to filter query results by a tree-scoped relationship. When the target field uses a String-based primary key, the value supplied by the client is concatenated directly into an HQL WHERE clause without parameter binding or quote escaping.

An authenticated user with query permission on an eligible entity can supply a crafted linkTreeVal that terminates the intended string literal and appends arbitrary HQL. Because HQL executes against the ORM session, injected subqueries can traverse any mapped entity accessible to the configured Hibernate session, including those outside the current scope-restriction policy.

Root Cause

The root cause is unsafe string concatenation during HQL construction in the Erupt JPA utilities. Review of the referenced source lines in EruptService.java, TypeUtil.java, and EruptJpaUtils.java shows that the linkTreeVal value is inserted into the generated HQL fragment without binding it as a prepared parameter. The String-keyed code path does not quote-escape or validate input, breaking the tree-scope filter when quotes are injected.

Attack Vector

Exploitation requires network access to the Erupt admin API and authenticated credentials with query permission on a target entity whose linkTree relation uses a String key. The attacker issues a POST request to /erupt-api/data/table/{erupt} with a linkTreeVal value containing a terminating quote followed by injected HQL such as an OR '1'='1 clause or a boolean subquery referencing another mapped entity. The server returns rows that would otherwise be filtered out by the tree scope, resulting in confidentiality impact. The vulnerability does not grant integrity or availability impact; it is read-only data exposure through the ORM.

See the VulnCheck Erupt HQL Injection Advisory for the technical write-up and the Erupt source references illustrating the vulnerable concatenation.

Detection Methods for CVE-2026-111390

Indicators of Compromise

POST requests to /erupt-api/data/table/{erupt} where the JSON body contains a linkTreeVal value with embedded single quotes, OR, AND, or parenthesized subqueries.
Unexpected result-set sizes returned from data table queries that normally return a bounded tree scope.
Application logs showing Hibernate HQL statements with concatenated literals containing boolean tautologies.

Detection Strategies

Enable Hibernate SQL/HQL logging and alert on generated queries containing suspicious patterns such as ' OR ' or nested SELECT clauses in filter positions.
Deploy a web application firewall rule inspecting the linkTreeVal JSON field for quote characters and HQL keywords.
Audit authenticated sessions that invoke the data table API against entities they rarely access.

Monitoring Recommendations

Centralize Erupt application and access logs and retain request bodies for the /erupt-api/data/table/* endpoints.
Monitor privileged accounts with broad query permissions for anomalous query volumes or payload shapes.
Correlate repeated 200-OK responses with abnormally large row counts to a single erupt entity path.

How to Mitigate CVE-2026-111390

Immediate Actions Required

Restrict access to the Erupt admin interface to trusted network segments and authenticated administrators only.
Review and minimize query permissions assigned to Erupt roles, especially on entities with String-keyed linkTree relationships.
Enable request logging on /erupt-api/data/table/* and review historical traffic for malformed linkTreeVal payloads.

Patch Information

No fixed version was published in the referenced NVD record at the time of writing. Monitor the Erupt GitHub repository for releases subsequent to 2.3.0 and apply the vendor fix when available. Consult the VulnCheck advisory for updates.

Workarounds

Place the Erupt admin API behind a reverse proxy that rejects linkTreeVal values containing single quotes or HQL keywords.
Remove or disable @EruptField(edit = @Edit(type = EditType.TREE)) configurations whose target entities use String primary keys until a patch is applied.
Apply the principle of least privilege by revoking query permissions on sensitive entities for all non-administrative Erupt roles.

bash

# Example reverse-proxy block (NGINX) rejecting suspicious linkTreeVal payloads
location /erupt-api/data/table/ {
    if ($request_body ~* "linkTreeVal\"\s*:\s*\"[^\"]*(['\"]|\bOR\b|\bAND\b|--)") {
        return 403;
    }
    proxy_pass http://erupt_backend;
}