Executive brief
BharatMLStack is a machine learning application framework that includes a web-based UI component called Trufflebox for data visualization and analysis. An attacker can inject malicious scripts through the GenericNumerixTable component, allowing them to steal user sessions, redirect users to phishing sites, or deface the application interface when users view or interact with compromised data.
Technical details
The vulnerability is a reflected or stored cross-site scripting (XSS) flaw in the GenericNumerixTable.jsx component of the Trufflebox UI in BharatMLStack. The root cause is insufficient input validation or output encoding when rendering table data, allowing an attacker to inject arbitrary JavaScript code. An attacker can craft a malicious input (e.g., via a table cell or parameter) that executes in the victim's browser when the page is rendered. No authentication bypass is required if the XSS is reflected via URL parameters, though stored XSS could affect all users viewing the compromised data. A patch is available; users should upgrade to a version newer than v1.3.0.
Affected products
- BharatMLStack BharatMLStack up to and including v1.3.0
Timeline
- 2026-09-15: disclosed