Executive brief
BharatMLStack's Trufflebox UI stores authentication tokens, user credentials, and session IDs in browser localStorage, which is accessible to any JavaScript code running on the page. An attacker exploiting an XSS vulnerability or injecting malicious scripts could steal these credentials, gaining unauthorized access to user accounts and ML infrastructure resources.
Technical details
The vulnerability is an insecure storage issue in the Trufflebox UI component of BharatMLStack. The application stores sensitive authentication data—JWT tokens, full user objects, and session IDs—in browser localStorage instead of using more secure alternatives like httpOnly cookies. This makes the credentials vulnerable to XSS (cross-site scripting) attacks, where injected JavaScript can read and exfiltrate these tokens. No authentication or special privileges are required to exploit this; any XSS vulnerability in the application becomes a direct path to credential theft. Patches or version updates addressing this should move sensitive data to httpOnly, secure cookies or implement Content Security Policy (CSP) protections.
Affected products
- Meesho BharatMLStack up to and including v1.3.0
Timeline
- 2026-09-15: disclosed