Read the docs
TI-2026-69607 Aliases CVE-2026-107303GHSA-9ffp-22j7-56r2

Stored cross-site scripting in JHipster generated applications

Priority HIGH 66CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

generator-jhipster before 9.4.0 and react-jhipster before 1.1.0 generated applications open stored Blob data with an attacker-controlled ContentType (CWE-79). An authenticated user with write access to a Blob-bearing entity can store active HTML or SVG that runs under the application origin when a privileged user opens it. Exploitability depends on the content security policy and browser Blob handling.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through generated REST endpoints, and pass them to the generated openFile helper in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it. Exploitability depends on the generated application's content security policy and target-browser Blob behavior. This issue is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00324 25th percentileScored 2026-11-07
Fix Fixed generator-jhipster (jhipster): 9.4.0react-jhipster (jhipster): 1.1.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jhipstergenerator-jhipsterbefore 9.4.09.4.0Patch availableCNA
jhipsterreact-jhipsterbefore 1.1.01.1.0Patch availableCNA
—generator-jhipster (npm)before 9.4.09.4.0Patch availableGHSA-9ffp-22j7-56r2
—react-jhipster (npm)before 1.1.01.1.0Patch availableGHSA-9ffp-22j7-56r2
  • generator-jhipster Vendorjhipster Affected before 9.4.0 Fixed in 9.4.0 Patch available CNA
  • react-jhipster Vendorjhipster Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA
  • generator-jhipster (npm) Vendor— Affected before 9.4.0 Fixed in 9.4.0 Patch available GHSA-9ffp-22j7-56r2
  • react-jhipster (npm) Vendor— Affected before 1.1.0 Fixed in 1.1.0 Patch available GHSA-9ffp-22j7-56r2

Remediation

Upgrade generator-jhipster to 9.4.0 and react-jhipster to 1.1.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA generator-jhipster (jhipster) Fixed in 9.4.0
  • Fix · CNA react-jhipster (jhipster) Fixed in 1.1.0
  • Fix · GHSA-9ffp-22j7-56r2 generator-jhipster (npm) Fixed in 9.4.0 Advisory →
  • Fix · GHSA-9ffp-22j7-56r2 react-jhipster (npm) Fixed in 1.1.0 Advisory →

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107303
  2. 2026-10-08 Alias added: GHSA-9ffp-22j7-56r2
  3. 2026-10-09 CISA SSVC decision points changed
  4. 2026-10-09 Priority changed: MEDIUM → HIGH

References

Other 5

  • TI-2025-28302 Improper access control in JHipster CVSS 3.1HIGH 8.0
  • TI-2022-08628 SQL Injection when creating an application with Reactive SQL backend CVSS 3.1HIGH 8.1
  • TI-2025-22380 CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework CVSS 3.1HIGH 7.7
  • TI-2019-12273 A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through… CVSS 3.1CRITICAL 9.8
  • TI-2026-69614 SQL injection in JHipster reactive applications via sort parameter CVSS 3.1HIGH 8.8
  • TI-2015-08085 JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken… CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences