{"action":"Upgrade generator-jhipster to 9.4.0 or later.","affected":[{"fixed":"9.4.0","introduced":"0"}],"component":"generator-jhipster","cve_ids":["CVE-2026-107303"],"ecosystem":"npm","epss":0.00261,"exploited":false,"fixed_versions":["9.4.0"],"ghsa_id":"GHSA-9ffp-22j7-56r2","id":"tcs_01M5KFFP3C4GF2ZK79JV6VCJKA","modified_at":"2026-10-08T18:00:09.700221111Z","published_at":"2026-10-08T17:40:29Z","references":["https://osv.dev/vulnerability/GHSA-9ffp-22j7-56r2","https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-9ffp-22j7-56r2","https://github.com/jhipster/generator-jhipster/pull/34807","https://github.com/jhipster/generator-jhipster/commit/efe95edd4dedc3379735094936439410a51ce3d9","https://github.com/jhipster/generator-jhipster","https://github.com/jhipster/generator-jhipster/releases/tag/v9.4.0"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-9ffp-22j7-56r2","url":"https://osv.dev/vulnerability/GHSA-9ffp-22j7-56r2"}],"summary":"JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob"}