CVE-2026-39038
Received Received - Intake

Cross Site Scripting (XSS) in BharatMLStack Trufflebox UI

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: MITRE

Description
BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-39038
EUVD
EUVD-2026-78942

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bharatmlstack trufflebox_ui to 1.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in BharatMLStack's Trufflebox UI component, specifically in the GenericNumerixTable.jsx file. The issue occurs because the component uses React's dangerouslySetInnerHTML to render user-controlled data from the Horizon API without proper sanitization.

Detection Guidance

Check for the presence of GenericNumerixTable.jsx in BharatMLStack installations up to v1.3.0. Inspect the file for use of React's dangerouslySetInnerHTML with user-controlled data from the Horizon API, particularly the InfixExpression field. Look for unsanitized input handling.

Impact Analysis

An authenticated attacker can inject malicious JavaScript via the InfixExpression field, which executes in the browsers of users viewing the Numerix table. The payload can steal JWT tokens stored in localStorage, leading to potential account takeover when combined with another vulnerability (CVE-2026-39039).

Mitigation Strategies

Sanitize user input before rendering with dangerouslySetInnerHTML. Use DOMPurify to clean the InfixExpression field data. Update BharatMLStack to a patched version if available. Monitor for suspicious activity or unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39038. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart