CVE-2026-77874

A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the JsonPathHelper.appendInlinedJsonPathIncludingPassingClause() method, specifically when using Oracle, DB2, or HANA database dialects. Successful exploitation can lead to authorization bypass and significant data exfiltration, enabling the attacker to access sensitive information from the database.

This flaw is rated as Important. An authenticated remote attacker can bypass authorization controls and exfiltrate data from the underlying database by injecting SQL through the JSON path parameter in Hibernate ORM. This is due to improper escaping of the leading JSON path segment in certain database dialects, which is reachable in default configurations of applications using Hibernate ORM's Criteria API.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, applications using Hibernate ORM should avoid passing untrusted user-controlled input directly as JSON path arguments to json_query, json_exists, or json_value functions. If dynamic JSON querying is necessary, strictly validate or whitelist the JSON path input against a predefined pattern (e.g., allowing only alphanumeric characters and dots) before use.