CVE-2026-107303

Summary

JHipster applications can store and serve attacker-controlled Blob data with malicious content types that execute in the context of the application origin when opened by privileged users. This allows authenticated users to potentially execute arbitrary code or perform cross-site scripting attacks.

Exploitability

Exploitation requires an authenticated user with write access to a Blob-bearing entity, and depends on the target application's Content Security Policy and browser Blob handling behavior, making it moderately difficult to exploit but not impossible.

Blast radius

The impact could be significant as attackers can potentially execute malicious code in the context of the application origin when privileged users open the crafted files, leading to potential data exfiltration or further compromise of the application.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to generator-jhipster 9.4.0 and react-jhipster 1.1.0 to fix the vulnerability in Blob handling and content type validation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.