PT-2026-24891 · Jcharis · Machine-Learning-Web-Apps

Zast.Ai · Published 2026-03-11 · Updated 2026-03-12 · CVE-2026-3962

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jcharis Machine-Learning-Web-Apps versions prior to a6996b634d98ccec4701ac8934016e8175b60eb5

Description A security issue exists in Jcharis Machine-Learning-Web-Apps. The render template function within the Jinja2 Template Handler component, located in the file Machine-Learning-Web-Apps-master/Build-n-Deploy-Flask-App-with-Waypoint/app/app.py, is susceptible to cross site scripting. This manipulation can be exploited remotely. The exploit is publicly available. The product utilizes a rolling release model, meaning specific version details for affected and updated releases are unavailable. The project was notified of the issue but has not yet responded.

Recommendations Versions prior to a6996b634d98ccec4701ac8934016e8175b60eb5: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-3962

Affected Products

Machine-Learning-Web-Apps

References · 10

• 🔥 https://github.com/Jcharis/Machine-Learning-Web-Apps/issues/15#issue-3995372171 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3962 · Security Note
• https://github.com/Jcharis/Machine-Learning-Web-Apps/issues/15 · Note
• https://t.me/CVEtracker/47199 · Telegram Post
• https://vuldb.com/?id.350391 · Note
• https://github.com/Jcharis/Machine-Learning-Web-Apps · Note
• https://vuldb.com/?ctiid.350391 · Note
• https://vuldb.com/?submit.768226 · Note
• https://twitter.com/cyberbivash/status/2031902263464071651 · Twitter Post
• https://twitter.com/CVEnew/status/2031867577673060717 · Twitter Post