Description
Applications generated by generator-jhipster v9.2.0 can persist user-controlled Blob ContentType values and later use those values as the MIME type for client-side Blob objects. The shared generated openFile helper creates an object URL from the Blob and opens it in a new window.
Recommendation
Update the react-jhipster package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.0.3
- Patched version(s): 1.1.0
References
Could your website be exposed too?
SmartScanner can check your website for JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
- Trix: Stored XSS via HTMLParser attribute injection on paste - CVE-2026-73428
- Fabric.js Affected by Stored XSS via SVG Export - CVE-2026-27013
- Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order - CVE-2026-45665
You might also like:
See something that needs correcting? Let us knowUpdated October 08, 2026