CVE-2026-107303JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
Updated under an hour ago ()
Does this affect you?
It affects jhipster generator-jhipster and 1 other product. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.26%, higher than 17% of scored CVEs.
Do this next
Free account, 1 product
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through generated REST endpoints, and pass them to the generated openFile helper in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it. Exploitability depends on the generated application's content security policy and target-browser Blob behavior. This issue is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.
- CVSS
- 7.6 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.26% (percentile 17)
- Assigned by
- GitHub_M
- NVD analysis
- Undergoing Analysis
- Record last updated
- Oct 9, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
jhipster generator-jhipster jhipster:generator_jhipster (from the name) | before 9.4.0 | CNA record |
jhipster react-jhipster jhipster:react_jhipster (from the name) | before 1.1.0 | CNA record |
References
- https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-9ffp-22j7-56r2x-refsource-confirm
- https://github.com/jhipster/generator-jhipster/pull/34807x-refsource-misc
- https://github.com/jhipster/generator-jhipster/commit/efe95edd4dedc3379735094936439410a51ce3d9x-refsource-misc
- https://github.com/jhipster/generator-jhipster/releases/tag/v9.4.0x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.