The vulnerability occurs in JHipster generator code that produces applications capable of storing arbitrary Blob data with a user‑specified ContentType. When the generated openFile helper builds a Blob URL, it uses the stored ContentType as the MIME type, allowing injected HTML or SVG to execute in the browser under the application’s origin. This leads to stored cross‑site scripting that can disclose or hijack authenticated session data and other credentials, matching CWE‑79.

Affected builds are those produced with generator‑jhipster versions earlier than 9.4.0 and react‑jhipster versions earlier than 1.1.0. Users who employ these versions to generate JHipster projects may have exposed endpoints that return the user‑controlled Blob data and ContentType, enabling the attack.

The CVSS score of 7.6 indicates high severity, and while an EPSS score is not available, the vulnerability is not currently listed in CISA KEV. Exploitation requires an authenticated user with write access to a Blob‑bearing entity, and the impact depends on the application’s content‑security policy and browser Blob handling. Because the flaw allows arbitrary HTML or SVG to run in the application’s origin, any privileged user who opens the stored file can suffer credential theft or other malicious actions. The attack vector is application‑level and only available to users with write permission on the affected entity.