GHSA-9FFP-22J7-56R2
Vulnerability from github – Published: 2026-10-08 17:40 – Updated: 2026-10-08 17:40Summary
Applications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated openFile helper creates an object URL from the Blob and opens it in a new window.
For Blob-bearing entities writable by normal authenticated users, this creates a stored XSS chain: attacker-controlled Blob content and MIME type are stored through the generated REST API, returned to privileged users, and opened as a same-origin Blob document from the generated Angular/React/Vue UI. Exploitability should be confirmed against the generated app’s CSP and target browsers.
Details
The root cause is a trust-boundary failure across generated server and client code. The generated entity REST resource accepts request bodies for entity creation and update. Unless an entity-specific authority is configured, the template omits method-level @PreAuthorize, leaving the endpoint available to any authenticated user under the global /api/** security rule.
The generated DTO/domain/mapper flow stores the companion <field>ContentType property as a plain String and persists it with the entity Blob data. The relevant templates include generators/spring-boot/templates/src/main/java/_package_/_entityPackage_/service/dto/_dtoClass_.java.ejs:96-122 and generators/java/generators/domain/templates/src/main/java/_package_/_entityPackage_/domain/_persistClass_.java.jhi.ejs:124-140. The generated code does not restrict MIME types, reject active document formats, or validate that the declared content type matches the uploaded bytes.
The dangerous sink is openFile in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs:49-64. It uses the returned contentType as the Blob type, creates an object URL, and calls globalThis.open(fileURL). Generated Angular, React, and Vue entity pages pass server-returned Blob data and ContentType into this helper, allowing active HTML or SVG content to be opened as a document under the application origin depending on CSP and browser behavior.
Core vulnerable code path:
// generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs:49-64
export const openFile = (data: string, contentType: string | null | undefined): void => {
contentType ??= '';
const byteCharacters = atob(data);
const byteNumbers = new Array(byteCharacters.length);
for (let i = 0; i < byteCharacters.length; i++) {
byteNumbers[i] = byteCharacters.codePointAt(i);
}
const byteArray = new Uint8Array(byteNumbers);
const blob = new Blob([byteArray], {
type: contentType,
});
const fileURL = globalThis.URL.createObjectURL(blob);
const win = globalThis.open(fileURL);
if (win) {
win.onload = () => URL.revokeObjectURL(fileURL);
The shared client sink trusts the incoming contentType, builds a Blob with that type, and opens it through a generated object URL. Active MIME types can therefore become executable documents when opened, depending on CSP and browser behavior.
POC
Preconditions: the target application is generated by generator-jhipster v9.2.0; it includes an entity with a Blob, AnyBlob, or ImageBlob field; the entity has no entityAuthority restriction or the attacker has write permission; the attacker has a normal account and a higher-privileged victim can view the entity detail or list page.
Reproduction: (1) Generate an application with a Blob-bearing entity, for example a Document entity with a payload AnyBlob field. (2) Authenticate as a normal user and send POST /api/documents with Authorization: Bearer and Content-Type: application/json. The request body contains a Base64-encoded active document in the payload field and a payloadContentType value such as text/html. (3) Confirm that the API returns HTTP 201 and that GET /api/documents/{id} returns the same payload and payloadContentType. (4) Have a privileged user open the generated entity detail or list page and click the Blob field’s Open link. Expected result: the browser opens a blob:/... document; where CSP and browser behavior permit script execution, the document can read Web Storage tokens or call same-origin APIs such as /api/account and privileged /api/admin/** endpoints as the victim.
Impact
A normal authenticated user can persist active content that a privileged user may open from the generated UI. Successful exploitation can result in stored cross-site scripting, JWT/localStorage/sessionStorage theft, sensitive API data disclosure, and privileged actions under the victim’s session. Default CSP may reduce exploitability, so deployments with relaxed CSP or browser behavior that allows script execution in opened Blob documents are at highest risk.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "generator-jhipster"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.3"
},
"package": {
"ecosystem": "npm",
"name": "react-jhipster"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-107303"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-08T17:40:29Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\nApplications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated `openFile` helper creates an object URL from the Blob and opens it in a new window.\n\nFor Blob-bearing entities writable by normal authenticated users, this creates a stored XSS chain: attacker-controlled Blob content and MIME type are stored through the generated REST API, returned to privileged users, and opened as a same-origin Blob document from the generated Angular/React/Vue UI. Exploitability should be confirmed against the generated app\u2019s CSP and target browsers.\n\n## Details\nThe root cause is a trust-boundary failure across generated server and client code. The generated entity REST resource accepts request bodies for entity creation and update. Unless an entity-specific authority is configured, the template omits method-level `@PreAuthorize`, leaving the endpoint available to any authenticated user under the global `/api/**` security rule.\n\nThe generated DTO/domain/mapper flow stores the companion `\u003cfield\u003eContentType` property as a plain `String` and persists it with the entity Blob data. The relevant templates include `generators/spring-boot/templates/src/main/java/_package_/_entityPackage_/service/dto/_dtoClass_.java.ejs:96-122` and `generators/java/generators/domain/templates/src/main/java/_package_/_entityPackage_/domain/_persistClass_.java.jhi.ejs:124-140`. The generated code does not restrict MIME types, reject active document formats, or validate that the declared content type matches the uploaded bytes.\n\nThe dangerous sink is `openFile` in `generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs:49-64`. It uses the returned `contentType` as the Blob type, creates an object URL, and calls `globalThis.open(fileURL)`. Generated Angular, React, and Vue entity pages pass server-returned Blob data and ContentType into this helper, allowing active HTML or SVG content to be opened as a document under the application origin depending on CSP and browser behavior.\n\nCore vulnerable code path:\n\n```typescript\n// generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs:49-64\nexport const openFile = (data: string, contentType: string | null | undefined): void =\u003e {\n contentType ??= \u0027\u0027;\n\n const byteCharacters = atob(data);\n const byteNumbers = new Array(byteCharacters.length);\n for (let i = 0; i \u003c byteCharacters.length; i++) {\n byteNumbers[i] = byteCharacters.codePointAt(i);\n }\n const byteArray = new Uint8Array(byteNumbers);\n const blob = new Blob([byteArray], {\n type: contentType,\n });\n const fileURL = globalThis.URL.createObjectURL(blob);\n const win = globalThis.open(fileURL);\n if (win) {\n win.onload = () =\u003e URL.revokeObjectURL(fileURL);\n```\n\nThe shared client sink trusts the incoming contentType, builds a Blob with that type, and opens it through a generated object URL. Active MIME types can therefore become executable documents when opened, depending on CSP and browser behavior.\n\n## POC\nPreconditions: the target application is generated by generator-jhipster v9.2.0; it includes an entity with a Blob, AnyBlob, or ImageBlob field; the entity has no entityAuthority restriction or the attacker has write permission; the attacker has a normal account and a higher-privileged victim can view the entity detail or list page.\n\nReproduction: (1) Generate an application with a Blob-bearing entity, for example a Document entity with a payload AnyBlob field. (2) Authenticate as a normal user and send POST /api/documents with Authorization: Bearer \u003cattacker-token\u003e and Content-Type: application/json. The request body contains a Base64-encoded active document in the payload field and a payloadContentType value such as text/html. (3) Confirm that the API returns HTTP 201 and that GET /api/documents/{id} returns the same payload and payloadContentType. (4) Have a privileged user open the generated entity detail or list page and click the Blob field\u2019s Open link. Expected result: the browser opens a blob:\u003ctarget-origin\u003e/... document; where CSP and browser behavior permit script execution, the document can read Web Storage tokens or call same-origin APIs such as /api/account and privileged /api/admin/** endpoints as the victim.\n\n## Impact\nA normal authenticated user can persist active content that a privileged user may open from the generated UI. Successful exploitation can result in stored cross-site scripting, JWT/localStorage/sessionStorage theft, sensitive API data disclosure, and privileged actions under the victim\u2019s session. Default CSP may reduce exploitability, so deployments with relaxed CSP or browser behavior that allows script execution in opened Blob documents are at highest risk.",
"id": "GHSA-9ffp-22j7-56r2",
"modified": "2026-10-08T17:40:29Z",
"published": "2026-10-08T17:40:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-9ffp-22j7-56r2"
},
{
"type": "WEB",
"url": "https://github.com/jhipster/generator-jhipster/pull/34807"
},
{
"type": "WEB",
"url": "https://github.com/jhipster/generator-jhipster/commit/efe95edd4dedc3379735094936439410a51ce3d9"
},
{
"type": "PACKAGE",
"url": "https://github.com/jhipster/generator-jhipster"
},
{
"type": "WEB",
"url": "https://github.com/jhipster/generator-jhipster/releases/tag/v9.4.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.