CVE-2026-39039

MEDIUMCVSS 5.3

Description

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.

Timeline

Published:September 15th, 2026 6:17 PM

Last modified:September 22nd, 2026 8:00 PM

CVSS Scoring

CVSS v3: 5.3 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-79

References & Reports

Advisories, patches, and third-party reports

https://github.com/Meesho/BharatMLStack
https://github.com/wincr4ck/security-advisories/blob/main/bharatmlstack-cve-writeup.md

Source: NIST NVD · Data may lag official sources by up to one minute