CVE-2026-107303: JHipster Applications Vulnerable to Stored XSS via Unrestricted Blob ContentType
Summary
CVE-2026-107303: Applications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. Affects generator-jhipster versions < 9.4.0. Fixed in 9.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JHipster is a development platform to generate, develop, and deploy Spring Boot + Angular/React/Vue web applications and Spring microservices. It provides a robust framework for building modern web applications with a focus on best practices and productivity. However, applications generated by JHipster version 9.2.0 have a vulnerability that allows for stored cross-site scripting (XSS) attacks due to improper handling of Blob ContentType values.
Vulnerability Detail
The vulnerability arises from a trust-boundary failure between the server and client code in applications generated by generator-jhipster v9.2.0. The generated REST API allows authenticated users to upload Blob data along with a ContentType that is not validated. This can lead to an attacker storing malicious content that can be executed when a privileged user accesses it. The generated code does not restrict MIME types or validate the content type against the uploaded data, allowing active HTML or SVG content to be opened as a document, which can lead to theft of sensitive information and unauthorized actions.
How To Fix
Minimum fixed version
9.4.0
This is the first release that contains the fix.
npm install generator-jhipster@9.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement strict Content Security Policy (CSP) headers to mitigate the risk of XSS attacks. Additionally, consider implementing server-side validation for the Blob ContentType to restrict it to safe MIME types.
Conclusion
The vulnerability identified as CVE-2026-107303 in JHipster applications poses a significant risk due to improper handling of Blob ContentType values. It is crucial for developers to update their packages to the latest versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for generator-jhipster →
FAQ
The vulnerability allows an attacker to store malicious content that can be executed by a privileged user, potentially leading to data theft and unauthorized actions.
You can use Vulert to monitor your application for this vulnerability. Simply upload your package-lock.json file to Vulert's playground at Vulert Scanner.
The CVSS score for this vulnerability is 7.6, indicating a high severity level.
Yes, implementing a strict Content Security Policy (CSP) and validating Blob ContentType on the server can help mitigate the risk.
If immediate updates are not possible, ensure that your application has strict CSP in place and monitor for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for generator-jhipster.
