CVE-2026-39039

Published: Sep 15, 2026Modified: Sep 22, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.6 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/Meesho/BharatMLStack

Source: cve@mitre.org

https://github.com/wincr4ck/security-advisories/blob/main/bharatmlstack-cve-writeup.md

Source: cve@mitre.org

Timeline

No history available yet.