Vulnpedia
← Search CVEs

CVE-2026-107303

HIGH 7.6

Published 2026-10-08 · Last modified 2026-10-09

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through generated REST endpoints, and pass them to the generated openFile helper in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it. Exploitability depends on the generated application's content security policy and target-browser Blob behavior. This issue is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.

ELEVATED IMPACT

Severe if exploited (CVSS 7.6), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 18th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.6CVSS 3.1 · HIGH

  • ConfidentialityHigh
  • IntegrityLow
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ⚠User interaction: A user must take an action (click / open a file)
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Jhipster

Products Generator Jhipster React Jhipster

Weakness (CWE)

  • CWE-79: : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • generator-jhipster npm

    pkg:npm/generator-jhipster

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 9.4.0
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9ffp-22j7-56r2/GHSA-9ffp-22j7-56r2.json"
  }
}
    GitHub Advisory Database · GHSA-9ffp-22j7-56r2 · Updated 2026-10-08T18:00:09.700221111Z
  • react-jhipster npm

    pkg:npm/react-jhipster

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 1.1.0
    Additional upstream package constraints
    {
  "database": {
    "last_known_affected_version_range": "<= 1.0.3",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9ffp-22j7-56r2/GHSA-9ffp-22j7-56r2.json"
  }
}
    GitHub Advisory Database · GHSA-9ffp-22j7-56r2 · Updated 2026-10-08T18:00:09.700221111Z

All CVSS metrics

  • HIGH 7.6 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
  • HIGH 7.6 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS