{"id":"CVE-2026-107303","published":"2026-10-08T18:17:19.277","lastModified":"2026-10-09T12:17:07.987","description":"JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through generated REST endpoints, and pass them to the generated openFile helper in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it. Exploitability depends on the generated application's content security policy and target-browser Blob behavior. This issue is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/jhipster/generator-jhipster/commit/efe95edd4dedc3379735094936439410a51ce3d9","tags":[]},{"url":"https://github.com/jhipster/generator-jhipster/pull/34807","tags":[]},{"url":"https://github.com/jhipster/generator-jhipster/releases/tag/v9.4.0","tags":[]},{"url":"https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-9ffp-22j7-56r2","tags":[]}],"exploitRefs":[{"url":"https://github.com/jhipster/generator-jhipster/commit/efe95edd4dedc3379735094936439410a51ce3d9","tags":[]},{"url":"https://github.com/jhipster/generator-jhipster/pull/34807","tags":[]},{"url":"https://github.com/jhipster/generator-jhipster/releases/tag/v9.4.0","tags":[]},{"url":"https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-9ffp-22j7-56r2","tags":[]}],"hasPoc":true,"ai":{"summary":"JHipster applications can store and serve attacker-controlled Blob data with malicious content types that execute in the context of the application origin when opened by privileged users. This allows authenticated users to potentially execute arbitrary code or perform cross-site scripting attacks.","exploitability":"Exploitation requires an authenticated user with write access to a Blob-bearing entity, and depends on the target application's Content Security Policy and browser Blob handling behavior, making it moderately difficult to exploit but not impossible.","blast_radius":"The impact could be significant as attackers can potentially execute malicious code in the context of the application origin when privileged users open the crafted files, leading to potential data exfiltration or further compromise of the application.","remediation":"Upgrade to generator-jhipster 9.4.0 and react-jhipster 1.1.0 to fix the vulnerability in Blob handling and content type validation.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","xss","blob"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:23:11.129Z"}}