CyberRota Analysis
AI-GeneratedBharatMLStack versions up to and including v1.3.0 are vulnerable due to the Trufflebox UI storing sensitive information, such as JWT authentication tokens, user objects, and session IDs, in the browser's localStorage, making it accessible to any JavaScript executed on the page. This could lead to unauthorized access and session hijacking if an attacker can inject malicious scripts. Organizations using these versions should prioritize remediation to protect user data and maintain application security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.