Stored XSS in generator-jhipster Generated Apps via Unrestricted Blob ContentType (CVE-2026-107302)

Vulnerability Overview Vulnerability Name: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob Description: Applications generated via v9.2.0 allow users to persist the ContentType value of a Blob and subsequently use these values as the MIME type for client-side Blob objects. The generated utility function creates an object URL from the Blob and opens it in a new window. For Blob-bearing entities that can be written by authenticated normal users, this creates a Stored XSS attack chain: attacker-controlled Blob content and MIME type are returned via the generated REST API and persisted, then opened as same-origin Blob documents in the generated Angular/React/Vue UI. Exploitability should be confirmed based on the CSP and browser behavior of the generated application. Impact Scope Affected Versions: - (npm): <9.3.0 - (npm): <=1.0.3 Fixed Versions: - (npm): 1.1.0 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Changed - Confidentiality: High - Integrity: Low - Availability: None CVSS Score: 7.8 / 10 CVE ID: CVE-2026-107302 Remediation Fixed Version: (npm): 1.1.0 POC Code Impact Authenticated normal users can persist active content that can be opened by privileged users. Successful exploitation may lead to stored cross-site scripting, JWT access token leakage, sensitive API data disclosure, and execution of privileged operations within the victim's session. The default CSP may reduce exploitability, but deployed Blob documents with permissive CSPs or browser behaviors allowing script execution are at the highest risk.

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in generator-jhipster Generated Apps via Unrestricted Blob ContentType (CVE-2026-107302)

More from this source