PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39040 Meesho CVE debrief

A Cross Site Scripting (XSS) vulnerability exists in BharatMLStack up to and including 1.3.0 via the Trufflebox UI (trufflebox-ui) component in ExpressionViewModal.jsx. This vulnerability has a CVSS score of 5.4 and a severity of MEDIUM. The vulnerability is located in the ExpressionViewModal.jsx file of the Trufflebox UI component. Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact on their systems. The CVE record and NVD vulnerability detail page provide information on this vulnerability.

Vendor
Meesho
Product
BharatMLStack
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-15
Original CVE updated
2026-09-21
Advisory published
2026-09-15
Advisory updated
2026-09-21

Who should care

Defenders responsible for BharatMLStack deployments should assess exposure and prioritize verification of inventory and potential impact. They should verify the presence of BharatMLStack up to and including 1.3.0 in their inventory and assess the potential impact of this vulnerability on their systems.

Why it matters

This CVE record indicates a Cross Site Scripting (XSS) vulnerability in BharatMLStack up to and including 1.3.0. Defenders responsible for BharatMLStack deployments should assess exposure and prioritize verification of inventory and potential impact.

  • Defenders need to verify the presence of BharatMLStack up to and including 1.3.0 in their inventory
  • Defenders need to assess the potential impact of this vulnerability on their systems
  • Defenders may need to apply patches or mitigations to address this vulnerability

Technical summary

The BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the Trufflebox UI (trufflebox-ui) component in ExpressionViewModal.jsx. The CVSS score for this vulnerability is 5.4, indicating a MEDIUM severity. The vulnerability is located in the ExpressionViewModal.jsx file of the Trufflebox UI component. The CVE record and NVD vulnerability detail page provide information on this vulnerability.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact on their systems.

Recommended defensive actions

  • Verify the presence of BharatMLStack up to and including 1.3.0 in your inventory
  • Assess the potential impact of this vulnerability on your systems
  • Consider applying patches or mitigations to address this vulnerability

Evidence notes

The CVE record and NVD vulnerability detail page provide information on this vulnerability, including its CVSS score and severity. The evidence is based on the official CVE Program record and the NIST NVD detail page. The vulnerability affects BharatMLStack up to and including 1.3.0. The Trufflebox UI (trufflebox-ui) component in ExpressionViewModal.jsx is vulnerable to Cross Site Scripting (XSS).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39040 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39040

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39040 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39040

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.