CVE-2026-39038: BharatMLStack Trufflebox UI XSS Vulnerability

CVE-2026-39038 Overview

CVE-2026-39038 is a Cross-Site Scripting (XSS) vulnerability affecting BharatMLStack versions up to and including v1.3.0. The flaw resides in the Trufflebox UI component (trufflebox-ui), specifically within the GenericNumerixTable.jsx file. An attacker can inject malicious script content that executes in the browser context of a user who interacts with the affected UI element. The issue is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions against the BharatMLStack Trufflebox UI.

Affected Products

BharatMLStack versions up to and including v1.3.0
Trufflebox UI component (trufflebox-ui)
GenericNumerixTable.jsx component

Discovery Timeline

2026-09-15 - CVE-2026-39038 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-39038

Vulnerability Analysis

The vulnerability is a reflected or stored Cross-Site Scripting flaw in the Trufflebox UI of BharatMLStack. The affected React component GenericNumerixTable.jsx renders user-influenced values without sufficient neutralization of HTML or JavaScript content. When an authenticated user views the affected table, injected payloads execute in the browser context. Exploitation requires user interaction, and the impact crosses a security scope boundary, affecting the confidentiality and integrity of the user session. See the GitHub CVE Writeup for details.

Root Cause

The root cause is improper output encoding in the GenericNumerixTable.jsx React component. Data flowing into the table cells is rendered without contextual escaping, allowing attacker-controlled input to be interpreted as executable markup instead of literal text. This is a classic client-side [CWE-79] pattern where untrusted data reaches the DOM without sanitization.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker supplies a crafted payload through an input field or data source that the Trufflebox UI later renders in the GenericNumerixTable.jsx view. When a victim loads the page, the injected script executes in their session. Attackers can then steal authentication tokens, perform actions on behalf of the user, or pivot to other components of the BharatMLStack platform.

No verified proof-of-concept code is published in the NVD entry. Refer to the BharatMLStack CVE writeup for exploitation specifics.

Detection Methods for CVE-2026-39038

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror= or onload=, or javascript: URIs stored in BharatMLStack data fields rendered by GenericNumerixTable.jsx.
Anomalous outbound requests from user browsers to attacker-controlled domains following interaction with the Trufflebox UI.
Session tokens or API keys appearing in web server or proxy logs as query parameters.

Detection Strategies

Review application logs and database entries for HTML tags or JavaScript syntax stored in fields consumed by the Trufflebox UI.
Deploy a Content Security Policy (CSP) in report-only mode to surface script execution violations from the Trufflebox UI.
Run static analysis on the trufflebox-ui codebase to identify uses of dangerouslySetInnerHTML or unescaped variable interpolation.

Monitoring Recommendations

Monitor authentication logs for unusual session reuse, geographic anomalies, or token replay following Trufflebox UI access.
Alert on CSP violation reports originating from pages that render GenericNumerixTable.
Track ingress data feeds to the BharatMLStack platform for payloads containing script markup or encoded variants.

How to Mitigate CVE-2026-39038

Immediate Actions Required

Upgrade BharatMLStack to a version later than v1.3.0 once the maintainers publish a fix addressing the GenericNumerixTable.jsx component.
Restrict access to the Trufflebox UI to trusted networks and authenticated users until a patch is applied.
Audit stored data rendered by Trufflebox UI for existing injected payloads and sanitize any that are found.

Patch Information

At the time of publication, the NVD entry lists BharatMLStack up to and including v1.3.0 as affected. No vendor advisory URL is included in the NVD record. Consult the BharatMLStack CVE writeup and the upstream BharatMLStack repository for the latest patched release and remediation guidance.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Sanitize all user-supplied data on both server ingress and client render paths, using libraries such as DOMPurify before interpolation into the DOM.
Replace any use of dangerouslySetInnerHTML in GenericNumerixTable.jsx with safe React text rendering that escapes HTML entities by default.

bash

# Example Content-Security-Policy header to limit XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; report-uri /csp-report";