EUVD-2026-78942
GHSA-c658-x3m3-4cv3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Standard stored XSS in an admin ML console: payload injection most plausibly needs authenticated write access (PR:L), needs a victim to view the page (UI:R), and crosses into the browser context (S:C, C:L/I:L).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.
AnalysisAI
Cross-site scripting in the Trufflebox UI (trufflebox-ui) of BharatMLStack up to and including v1.3.0 allows injected script to run in a logged-in operator's browser when the affected GenericNumerixTable.jsx table view renders unsanitized data. Impact is confined to the victim's browser session - limited confidentiality and integrity (C:L/I:L) with no server-side code execution or availability impact (A:N) - and exploitation requires user interaction, meaning an operator must load the poisoned table view. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the Trufflebox UI (trufflebox-ui) web console of BharatMLStack ≤ v1.3.0, specifically the GenericNumerixTable.jsx table-rendering component, which fails to sanitize/escape data before rendering it in the DOM. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity client-side XSS (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with low real-world urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis; confirm with the project whether a release later than v1.3.0 fixes GenericNumerixTable.jsx and, if so, upgrade to that version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today