CVE-2026-107303

HighCVSS 7.6

Published: 08/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

JHipster prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0 has a vulnerability where generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through REST endpoints, and pass them to the generated openFile helper. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it.

Risk Assessment

An attacker can inject malicious content that executes in the application context, potentially leading to data theft or session hijacking.

Recommendation

It is recommended to upgrade generator-jhipster to 9.4.0 and react-jhipster to 1.1.0 or later.

Other vulnerabilities in JHipster

CVE-2026-107375High
JHipster from 7.0.0 until 9.4.0 has a vulnerability in generated reactive applications (Spring WebFlux, Spring Data R2DBC, SQL). The attacker-controlled sort request parameter is passed into createOrderByFields in EntityManager_reactive.java.ejs, and rendered into the SQL ORDER BY clause without validation or quoting. The R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can read sensitive tables, modify or delete data, or drop tables.

Original NVD description (English source)

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through generated REST endpoints, and pass them to the generated openFile helper in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it. Exploitability depends on the generated application's content security policy and target-browser Blob behavior. This issue is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS