{"id":"CVE-2026-107303","revision":"4ba5f9e129a24a6caa3dfe8887058c3d","records":[{"revision":"4ba5f9e129a24a6caa3dfe8887058c3d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107303","aliases":[],"title":"JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob","description":"JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through generated REST endpoints, and pass them to the generated openFile helper in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it. Exploitability depends on the generated application's content security policy and target-browser Blob behavior. This issue is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.","state":0,"publishedAt":"2026-10-08T17:23:04.706+00:00","modifiedAt":"2026-10-09T11:41:09.192+00:00","affected":[{"ecosystem":"Vendor product","name":"generator-jhipster","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"jhipster\",\n                    \"product\": \"generator-jhipster\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 9.4.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-jhipster","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"jhipster\",\n                    \"product\": \"react-jhipster\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.1.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","score":7.6,"severity":"HIGH"}],"references":["https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-9ffp-22j7-56r2","https://github.com/jhipster/generator-jhipster/pull/34807","https://github.com/jhipster/generator-jhipster/commit/efe95edd4dedc3379735094936439410a51ce3d9","https://github.com/jhipster/generator-jhipster/releases/tag/v9.4.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107303","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107303","identifiers":["CVE-2026-107303"]},"retained":false,"historicalAffected":[]}],"coverage":[]}