CVE-2026-39040
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.
Risk Assessment
An attacker could inject malicious scripts that execute in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Update BharatMLStack to the latest version or apply patches that mitigate XSS in the Trufflebox UI component.
Other vulnerabilities in BharatMLStack
See all- CVE-2026-39039Medium
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.
- CVE-2026-39038Medium
BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.
Original NVD description (English source)
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS