CVE-2026-39039 Details
Description
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.
A vulnerability exists in BharatMLStack Trufflebox UI component, all versions up to and including v1.3.0, where sensitive information such as the JWT authentication token, user object, and session ID are stored in the browser's localStorage. This storage method is insecure as it is accessible to any JavaScript running on the page, allowing for potential exploitation. The vulnerability is exacerbated by two stored cross-site scripting (XSS) flaws in the same component, which can be exploited to execute JavaScript in the context of the user.
To address this vulnerability, remove the storage of sensitive tokens in localStorage and instead use httpOnly cookies, which are not accessible to JavaScript. Additionally, add CSRF protection to safeguard against cross-site request forgery attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Meesho/BharatMLStack | [email protected] | ProductVendor |
| https://github.com/wincr4ck/security-advisories/blob/main/bharatmlstack-cve-writeup.md | [email protected] | BundleExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Meesho BharatMLStack | <= 1.3.0 (semver) |
CPE
Remediation
| |
| Meesho BharatMLStack TruffleBox UI | <= 1.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |