Every CVESearch/Get API key

GHSA-wpvf-5mc3-hv6m

Duplicate Advisory: Querydsl SQL/HQL injection

9.8 CriticalFix available

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6q3q-6v5j-h6vg. This link is maintained to preserve external references.

Original Description

Querydsl 5.1.0 allows SQL/HQL injection in orderBy in JPAQuery.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

What each source reports

GitHub Advisories Score used9.8

Duplicate Advisory: Querydsl SQL/HQL injection

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6q3q-6v5j-h6vg. This link is maintained to preserve external references.

Original Description

Querydsl 5.1.0 allows SQL/HQL injection in orderBy in JPAQuery.

Record
GHSA-wpvf-5mc3-hv6m
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSV9.8

Duplicate Advisory: Querydsl SQL/HQL injection

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6q3q-6v5j-h6vg. This link is maintained to preserve external references.

Original Description

Querydsl 5.1.0 allows SQL/HQL injection in orderBy in JPAQuery.

Record
GHSA-wpvf-5mc3-hv6m
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSVROOT-APP-MAVEN-GHSA-wpvf-5mc3-hv6mNo score

GHSA-wpvf-5mc3-hv6m in com.querydsl:querydsl-apt - Patched by Root

Root has patched GHSA-wpvf-5mc3-hv6m in the com.querydsl:querydsl-apt package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-GHSA-wpvf-5mc3-hv6m
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
com.querydsl:querydsl-apt
Root:Maven
before 5.0.0-aikido.3
5.0.0-aikido.35.1.0-aikido.3
com.querydsl:querydsl-jpa
Root:Maven
before 5.0.0-aikido.3
5.0.0-aikido.35.1.0-aikido.3
io.root.com.querydsl:querydsl-apt
Root:Maven
before 5.0.0-root.io.3
5.0.0-root.io.35.1.0-root.io.3
io.root.com.querydsl:querydsl-jpa
Root:Maven
before 5.0.0-root.io.3
5.0.0-root.io.35.1.0-root.io.3

History

History
RecordedChangedSources
affected
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-wpvf-5mc3-hv6m is a critical vulnerability (CVSS 9.8) in com.querydsl:querydsl-apt, published November 20, 2024. No source lists public exploit code. Fixed in com.querydsl:querydsl-apt 5.0.0-aikido.3.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open