CVE-2026-39039

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39039
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39039.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39039
Published
2026-09-15T00:00:00Z
Modified
2026-10-21T02:30:29Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39039.json"
}
References

Affected packages

Git / github.com/meesho/bharatmlstack

Affected ranges

Type
GIT
Repo
https://github.com/meesho/bharatmlstack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
3539dcc6f17daca4605ff8dd385a846631313952
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.3.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

flashring/v0.*
flashring/v0.0.2-aditya
go-sdk/v1.*
go-sdk/v1.0.0
horizon/v1.*
horizon/v1.0.0
horizon/v1.0.0-beta-103fad
horizon/v1.0.0-beta-803cdc
horizon/v1.0.0-beta-8bbdd4
horizon/v1.0.0-beta-cce73d
horizon/v1.1.0
horizon/v1.1.0-alpha-f90454
horizon/v1.1.0-beta-9ee5ed
horizon/v1.1.0-beta-a48087
horizon/v1.2.0
horizon/v1.2.0-beta-90a180
horizon/v1.3.0
horizon/v1.3.0-beta-5db162
inferflow/v1.*
inferflow/v1.0.0
inferflow/v1.0.0-alpha-9ef35e
inferflow/v1.0.0-beta-5db162
inferflow/v1.0.0-beta-90a180
numerix/v1.*
numerix/v1.0.0
numerix/v1.0.0-beta-5db162
numerix/v1.0.0-beta-90a180
numerix/v1.0.0-beta-cce73d
online-feature-store/v1.*
online-feature-store/v1.0.0
online-feature-store/v1.0.0-beta-10d111
online-feature-store/v1.0.0-beta-803cdc
online-feature-store/v1.0.0-beta-cce73d
online-feature-store/v1.0.0-beta-d74137
online-feature-store/v1.1.0
online-feature-store/v1.1.0-beta-90a180
online-feature-store/v1.2.0
online-feature-store/v1.2.0-beta-5db162
py-sdk/1.*
py-sdk/1.0.0
py-sdk/1.0.0b0
py-sdk/1.0.1
skye/v0.*
skye/v0.1.0-alpha-db0e8c
skye/v1.*
skye/v1.0.0
skye/v1.0.0-beta-bf1943
trufflebox-ui/v1.*
trufflebox-ui/v1.0.0
trufflebox-ui/v1.0.0-beta-803cdc
trufflebox-ui/v1.0.0-beta-8bbdd4
trufflebox-ui/v1.0.0-beta-c4eb80
trufflebox-ui/v1.1.0
trufflebox-ui/v1.1.0-beta-130d95
trufflebox-ui/v1.1.0-beta-872b57
trufflebox-ui/v1.1.0-beta-a48087
trufflebox-ui/v1.1.0-beta-b449eb
trufflebox-ui/v1.2.0
trufflebox-ui/v1.2.0-beta-90a180
trufflebox-ui/v1.3.0
trufflebox-ui/v1.3.0-beta-5db162

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39039.json"