CVE-2026-107303 in generator-jhipster
Summary
by MITRE • 10/08/2026
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through generated REST endpoints, and pass them to the generated openFile helper in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it. Exploitability depends on the generated application's content security policy and target-browser Blob behavior. This issue is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
JHipster serves as a prominent development platform designed to accelerate the creation, development, and deployment of modern web applications and microservice architectures by generating boilerplate code for various technologies. A significant security vulnerability was identified in versions prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0 within this ecosystem. The core issue stems from how generated applications handle binary large object data, commonly referred to as blobs, particularly regarding the persistence of user-supplied content type values alongside the actual file data. This architectural flaw allows for a stored cross-site scripting attack vector that exploits the trust relationship between authenticated users and the application's frontend logic.
The technical root cause lies in the interaction between the backend storage mechanisms and the frontend rendering helpers. When an authenticated user with write access to specific entities containing blob fields uploads or modifies data, they can control not only the binary content but also the companion ContentType metadata associated with that file. The generated REST endpoints persist these values without sufficient sanitization or validation against a whitelist of safe MIME types. Subsequently, when another user, potentially possessing higher privileges such as an administrator role, accesses this entity through the application interface, the frontend code invokes a helper function located in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. This helper retrieves the stored ContentType and directly passes it to the browser's Blob constructor when creating an object URL for display or download purposes.
This sequence of operations creates a dangerous execution context because modern browsers interpret the MIME type provided by the application rather than strictly relying on file content sniffing in all contexts, especially within specific iframe or blob URL scenarios. If an attacker stores active HTML or SVG content with a ContentType such as text/html or image/svg+xml, and if the target browser processes this Blob using that specified MIME type, the malicious script will execute within the security context of the application's origin. This effectively bypasses same-origin policy protections because the code runs as part of the trusted domain rather than an external source. The vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation known commonly as Cross-site Scripting (XSS).
The operational impact of this vulnerability is severe due to its potential for privilege escalation and data exfiltration. Although the initial trigger requires a normal authenticated user with write access, the payload execution occurs when a privileged user interacts with the compromised entity. This means that an attacker does not need administrative rights themselves but can leverage their lower-privileged account to plant malicious code that executes in the context of higher-privilege accounts. Depending on the application's Content Security Policy and specific browser implementations regarding Blob behavior, this could lead to session hijacking, unauthorized actions performed under the victim's identity, or theft of sensitive data accessible only to privileged users. The exploitability is contingent upon whether the generated application enforces strict CSP directives that might mitigate script execution from blob URLs, but relying on such configurations is risky as many default JHipster templates may not enforce sufficiently restrictive policies by default.
To remediate this vulnerability, developers must upgrade their dependencies to generator-jhipster version 9.4.0 or later and react-jhipster version 1.1.0 or later, where the issue has been addressed through improved input validation and safer handling of MIME types in the data utilities helper. For applications that cannot immediately upgrade, a temporary mitigation involves implementing server-side validation to ensure that only whitelisted safe MIME types are persisted for blob fields, thereby preventing the storage of executable content types like HTML or SVG. Additionally, enforcing strict Content Security Policy headers on all responses can help mitigate the impact by restricting where scripts can be loaded from and executed within the browser environment. It is also advisable to review any custom implementations of file handling logic that mirror this pattern to ensure they do not blindly trust user-supplied content types when creating object URLs for display or download operations, aligning with ATT&CK technique T1059 which covers command and script interpretation via web application interfaces.