What is GHSA-g88j-h94f-r5jp?

GHSA-g88j-h94f-r5jp is a security advisory published by GitHub Security Advisories with Medium severity. In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token,...

Which CVE IDs does GHSA-g88j-h94f-r5jp cover?

GHSA-g88j-h94f-r5jp covers the following CVE IDs: CVE-2026-39039. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g88j-h94f-r5jp?

GHSA-g88j-h94f-r5jp has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-g88j-h94f-r5jpMediumCVSS 5.3

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token,...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-39039 →

📋 Description

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-39039
https://github.com/Meesho/BharatMLStack
https://github.com/wincr4ck/security-advisories/blob/main/bharatmlstack-cve-writeup.md
https://github.com/advisories/GHSA-g88j-h94f-r5jp