CVE-2026-39038
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.
Risk Assessment
An attacker could inject malicious scripts that execute in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Update BharatMLStack to the latest version or apply patches that mitigate XSS in the Trufflebox UI component.
Other vulnerabilities in BharatMLStack
See all- CVE-2026-39040Medium
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.
- CVE-2026-39039Medium
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.
Original NVD description (English source)
BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS