{"id":"GHSA-wpvf-5mc3-hv6m","aliases":["ROOT-APP-MAVEN-GHSA-wpvf-5mc3-hv6m"],"status":"published","title":"Duplicate Advisory: Querydsl SQL/HQL injection","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6q3q-6v5j-h6vg. This link is maintained to preserve external references.\n\n## Original Description\nQuerydsl 5.1.0 allows SQL/HQL injection in orderBy in JPAQuery.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2024-11-20T21:30:50Z","modified":"2026-09-10T03:50:21Z","fixes":[{"ecosystem":"Root:Maven","package":"com.querydsl:querydsl-apt","fixed_in":["5.0.0-aikido.3","5.1.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.querydsl:querydsl-jpa","fixed_in":["5.0.0-aikido.3","5.1.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.querydsl:querydsl-apt","fixed_in":["5.0.0-root.io.3","5.1.0-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.querydsl:querydsl-jpa","fixed_in":["5.0.0-root.io.3","5.1.0-root.io.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Root:Maven","package":"com.querydsl:querydsl-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-aikido.3"},{"fixed":"5.1.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"com.querydsl:querydsl-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-aikido.3"},{"fixed":"5.1.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.querydsl:querydsl-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-root.io.3"},{"fixed":"5.1.0-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.querydsl:querydsl-jpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-root.io.3"},{"fixed":"5.1.0-root.io.3"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49203","tags":["advisory"]},{"url":"https://github.com/querydsl/querydsl/issues/3757","tags":["web"]},{"url":"https://github.com/querydsl/querydsl/releases/tag/QUERYDSL_5_1_0","tags":["web"]},{"url":"https://www.csirt.sk/querydsl-java-library-vulnerability-permits-sql-hql-injection.html","tags":["web"]},{"url":"https://github.com/OpenFeign/querydsl","tags":["web"]},{"url":"https://github.com/CSIRTTrizna/CVE-2024-49203","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wpvf-5mc3-hv6m"},{"url":"https://github.com/querydsl/querydsl","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-wpvf-5mc3-hv6m","title":"Duplicate Advisory: Querydsl SQL/HQL injection","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6q3q-6v5j-h6vg. This link is maintained to preserve external references.\n\n## Original Description\nQuerydsl 5.1.0 allows SQL/HQL injection in orderBy in JPAQuery.","status":"withdrawn","published":"2024-11-20T21:30:50Z","modified":"2024-12-03T18:54:04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"osv":[{"id":"GHSA-wpvf-5mc3-hv6m","title":"Duplicate Advisory: Querydsl SQL/HQL injection","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6q3q-6v5j-h6vg. This link is maintained to preserve external references.\n\n## Original Description\nQuerydsl 5.1.0 allows SQL/HQL injection in orderBy in JPAQuery.","status":"withdrawn","published":"2024-11-20T21:30:50Z","modified":"2026-09-10T03:50:21.283093301Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"ROOT-APP-MAVEN-GHSA-wpvf-5mc3-hv6m","title":"GHSA-wpvf-5mc3-hv6m in com.querydsl:querydsl-apt - Patched by Root","description":"Root has patched GHSA-wpvf-5mc3-hv6m in the com.querydsl:querydsl-apt package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-17T13:30:23Z","modified":"2026-08-17T15:15:04.911139676Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}