{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "9.4.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "jhipster",
        "purl": "pkg:brew/jhipster"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.5.2"
            },
            {
              "fixed": "9.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/generator-jhipster@9.4.0",
        "name": "generator-jhipster",
        "strategy": "registry",
        "subject_version": "9.4.0"
      }
    ]
  },
  "details": "## Summary\nApplications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated `openFile` helper creates an object URL from the Blob and opens it in a new window.\n\nFor Blob-bearing entities writable by normal authenticated users, this creates a stored XSS chain: attacker-controlled Blob content and MIME type are stored through the generated REST API, returned to privileged users, and opened as a same-origin Blob document from the generated Angular/React/Vue UI. Exploitability should be confirmed against the generated app\u2019s CSP and target browsers.\n\n## Details\nThe root cause is a trust-boundary failure across generated server and client code. The generated entity REST resource accepts request bodies for entity creation and update. Unless an entity-specific authority is configured, the template omits method-level `@PreAuthorize`, leaving the endpoint available to any authenticated user under the global `/api/**` security rule.\n\nThe generated DTO/domain/mapper flow stores the companion `\u003cfield\u003eContentType` property as a plain `String` and persists it with the entity Blob data. The relevant templates include `generators/spring-boot/templates/src/main/java/_package_/_entityPackage_/service/dto/_dtoClass_.java.ejs:96-122` and `generators/java/generators/domain/templates/src/main/java/_package_/_entityPackage_/domain/_persistClass_.java.jhi.ejs:124-140`. The generated code does not restrict MIME types, reject active document formats, or validate that the declared content type matches the uploaded bytes.\n\nThe dangerous sink is `openFile` in `generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs:49-64`. It uses the returned `contentType` as the Blob type, creates an object URL, and calls `globalThis.open(fileURL)`. Generated Angular, React, and Vue entity pages pass server-returned Blob data and ContentType into this helper, allowing active HTML or SVG content to be opened as a document under the application origin depending on CSP and browser behavior.\n\nCore vulnerable code path:\n\n```typescript\n// generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs:49-64\nexport const openFile = (data: string, contentType: string | null | undefined): void =\u003e {\n  contentType ??= \u0027\u0027;\n\n  const byteCharacters = atob(data);\n  const byteNumbers = new Array(byteCharacters.length);\n  for (let i = 0; i \u003c byteCharacters.length; i++) {\n    byteNumbers[i] = byteCharacters.codePointAt(i);\n  }\n  const byteArray = new Uint8Array(byteNumbers);\n  const blob = new Blob([byteArray], {\n    type: contentType,\n  });\n  const fileURL = globalThis.URL.createObjectURL(blob);\n  const win = globalThis.open(fileURL);\n  if (win) {\n    win.onload = () =\u003e URL.revokeObjectURL(fileURL);\n```\n\nThe shared client sink trusts the incoming contentType, builds a Blob with that type, and opens it through a generated object URL. Active MIME types can therefore become executable documents when opened, depending on CSP and browser behavior.\n\n## POC\nPreconditions: the target application is generated by generator-jhipster v9.2.0; it includes an entity with a Blob, AnyBlob, or ImageBlob field; the entity has no entityAuthority restriction or the attacker has write permission; the attacker has a normal account and a higher-privileged victim can view the entity detail or list page.\n\nReproduction: (1) Generate an application with a Blob-bearing entity, for example a Document entity with a payload AnyBlob field. (2) Authenticate as a normal user and send POST /api/documents with Authorization: Bearer \u003cattacker-token\u003e and Content-Type: application/json. The request body contains a Base64-encoded active document in the payload field and a payloadContentType value such as text/html. (3) Confirm that the API returns HTTP 201 and that GET /api/documents/{id} returns the same payload and payloadContentType. (4) Have a privileged user open the generated entity detail or list page and click the Blob field\u2019s Open link. Expected result: the browser opens a blob:\u003ctarget-origin\u003e/... document; where CSP and browser behavior permit script execution, the document can read Web Storage tokens or call same-origin APIs such as /api/account and privileged /api/admin/** endpoints as the victim.\n\n## Impact\nA normal authenticated user can persist active content that a privileged user may open from the generated UI. Successful exploitation can result in stored cross-site scripting, JWT/localStorage/sessionStorage theft, sensitive API data disclosure, and privileged actions under the victim\u2019s session. Default CSP may reduce exploitability, so deployments with relaxed CSP or browser behavior that allows script execution in opened Blob documents are at highest risk.",
  "id": "BREW-jhipster-CVE-2026-107303",
  "modified": "2026-10-08T20:22:50Z",
  "published": "2026-10-08T20:22:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-9ffp-22j7-56r2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jhipster/generator-jhipster/pull/34807"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jhipster/generator-jhipster/commit/efe95edd4dedc3379735094936439410a51ce3d9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jhipster/generator-jhipster"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jhipster/generator-jhipster/releases/tag/v9.4.0"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob",
  "upstream": [
    "GHSA-9ffp-22j7-56r2",
    "CVE-2026-107303"
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "generator-jhipster",
          "vendor": "jhipster",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.4.0"
            }
          ]
        },
        {
          "product": "react-jhipster",
          "vendor": "jhipster",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through generated REST endpoints, and pass them to the generated openFile helper in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it. Exploitability depends on the generated application\u0027s content security policy and target-browser Blob behavior. This issue is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0."
    }
  ],
  "id": "CVE-2026-107303",
  "lastModified": "2026-10-09T12:17:07.987",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107303",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-09T11:40:53.141795Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-08T18:17:19.277",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jhipster/generator-jhipster/commit/efe95edd4dedc3379735094936439410a51ce3d9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jhipster/generator-jhipster/pull/34807"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jhipster/generator-jhipster/releases/tag/v9.4.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-9ffp-22j7-56r2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "generator-jhipster"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "react-jhipster"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107303"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T17:40:29Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nApplications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated `openFile` helper creates an object URL from the Blob and opens it in a new window.\n\nFor Blob-bearing entities writable by normal authenticated users, this creates a stored XSS chain: attacker-controlled Blob content and MIME type are stored through the generated REST API, returned to privileged users, and opened as a same-origin Blob document from the generated Angular/React/Vue UI. Exploitability should be confirmed against the generated app\u2019s CSP and target browsers.\n\n## Details\nThe root cause is a trust-boundary failure across generated server and client code. The generated entity REST resource accepts request bodies for entity creation and update. Unless an entity-specific authority is configured, the template omits method-level `@PreAuthorize`, leaving the endpoint available to any authenticated user under the global `/api/**` security rule.\n\nThe generated DTO/domain/mapper flow stores the companion `\u003cfield\u003eContentType` property as a plain `String` and persists it with the entity Blob data. The relevant templates include `generators/spring-boot/templates/src/main/java/_package_/_entityPackage_/service/dto/_dtoClass_.java.ejs:96-122` and `generators/java/generators/domain/templates/src/main/java/_package_/_entityPackage_/domain/_persistClass_.java.jhi.ejs:124-140`. The generated code does not restrict MIME types, reject active document formats, or validate that the declared content type matches the uploaded bytes.\n\nThe dangerous sink is `openFile` in `generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs:49-64`. It uses the returned `contentType` as the Blob type, creates an object URL, and calls `globalThis.open(fileURL)`. Generated Angular, React, and Vue entity pages pass server-returned Blob data and ContentType into this helper, allowing active HTML or SVG content to be opened as a document under the application origin depending on CSP and browser behavior.\n\nCore vulnerable code path:\n\n```typescript\n// generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs:49-64\nexport const openFile = (data: string, contentType: string | null | undefined): void =\u003e {\n  contentType ??= \u0027\u0027;\n\n  const byteCharacters = atob(data);\n  const byteNumbers = new Array(byteCharacters.length);\n  for (let i = 0; i \u003c byteCharacters.length; i++) {\n    byteNumbers[i] = byteCharacters.codePointAt(i);\n  }\n  const byteArray = new Uint8Array(byteNumbers);\n  const blob = new Blob([byteArray], {\n    type: contentType,\n  });\n  const fileURL = globalThis.URL.createObjectURL(blob);\n  const win = globalThis.open(fileURL);\n  if (win) {\n    win.onload = () =\u003e URL.revokeObjectURL(fileURL);\n```\n\nThe shared client sink trusts the incoming contentType, builds a Blob with that type, and opens it through a generated object URL. Active MIME types can therefore become executable documents when opened, depending on CSP and browser behavior.\n\n## POC\nPreconditions: the target application is generated by generator-jhipster v9.2.0; it includes an entity with a Blob, AnyBlob, or ImageBlob field; the entity has no entityAuthority restriction or the attacker has write permission; the attacker has a normal account and a higher-privileged victim can view the entity detail or list page.\n\nReproduction: (1) Generate an application with a Blob-bearing entity, for example a Document entity with a payload AnyBlob field. (2) Authenticate as a normal user and send POST /api/documents with Authorization: Bearer \u003cattacker-token\u003e and Content-Type: application/json. The request body contains a Base64-encoded active document in the payload field and a payloadContentType value such as text/html. (3) Confirm that the API returns HTTP 201 and that GET /api/documents/{id} returns the same payload and payloadContentType. (4) Have a privileged user open the generated entity detail or list page and click the Blob field\u2019s Open link. Expected result: the browser opens a blob:\u003ctarget-origin\u003e/... document; where CSP and browser behavior permit script execution, the document can read Web Storage tokens or call same-origin APIs such as /api/account and privileged /api/admin/** endpoints as the victim.\n\n## Impact\nA normal authenticated user can persist active content that a privileged user may open from the generated UI. Successful exploitation can result in stored cross-site scripting, JWT/localStorage/sessionStorage theft, sensitive API data disclosure, and privileged actions under the victim\u2019s session. Default CSP may reduce exploitability, so deployments with relaxed CSP or browser behavior that allows script execution in opened Blob documents are at highest risk.",
  "id": "GHSA-9ffp-22j7-56r2",
  "modified": "2026-10-08T17:40:29Z",
  "published": "2026-10-08T17:40:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-9ffp-22j7-56r2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jhipster/generator-jhipster/pull/34807"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jhipster/generator-jhipster/commit/efe95edd4dedc3379735094936439410a51ce3d9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jhipster/generator-jhipster"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jhipster/generator-jhipster/releases/tag/v9.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob"
}