CVE-2026-39040
UnknownSummary
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.
Risk Assessment
An attacker could inject malicious scripts that execute in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Update BharatMLStack to the latest version or apply patches that mitigate XSS in the Trufflebox UI component.
Other vulnerabilities in BharatMLStack
See all- CVE-2026-39039Unknown
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.
- CVE-2026-39038Unknown
BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.
Original NVD description (English source)
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.