CVE-2026-39039
UnknownSummary
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.
Risk Assessment
Sensitive authentication data is exposed to theft by malicious scripts, potentially leading to user account takeover.
Recommendation
Change the storage of tokens and session data to a more secure method (e.g., HttpOnly cookies) and update BharatMLStack.
Other vulnerabilities in BharatMLStack
See all- CVE-2026-39040Unknown
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.
- CVE-2026-39038Unknown
BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.
Original NVD description (English source)
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.