CVE-2026-107303: JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
Applications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated openFile helper creates an object URL from the Blob and opens it in a new window.
For Blob-bearing entities writable by normal authenticated users, this creates a stored XSS chain: attacker-controlled Blob content and MIME type are stored through the generated REST API, returned to privileged users, and opened as a same-origin Blob document from the generated Angular/React/Vue UI. Exploitability should be confirmed against the generated app’s CSP and target browsers.
References
- github.com/advisories/GHSA-9ffp-22j7-56r2
- github.com/jhipster/generator-jhipster/commit/efe95edd4dedc3379735094936439410a51ce3d9
- github.com/jhipster/generator-jhipster/pull/34807
- github.com/jhipster/generator-jhipster/releases/tag/v9.4.0
- github.com/jhipster/generator-jhipster/security/advisories/GHSA-9ffp-22j7-56r2
- nvd.nist.gov/vuln/detail/CVE-2026-107303
Code Behaviors & Features
Detect and mitigate CVE-2026-107303 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →