CyberChef: Prototype pollution in Series Chart operation
Priority MEDIUM 56CWE-1321Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00135 2nd percentileScored 2026-11-07
Fix Fixed CyberChef (gchq): 11.2.0cyberchef (npm): 11.2.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gchq | CyberChef | before 11.2.0 | 11.2.0 | Patch available | CNA |
| — | cyberchef (npm) | before 11.2.0 | 11.2.0 | Patch available | GHSA-fx6f-382r-j72c |
- CyberChef Vendorgchq Affected before 11.2.0 Fixed in 11.2.0 Patch available CNA
- cyberchef (npm) Vendor— Affected before 11.2.0 Fixed in 11.2.0 Patch available GHSA-fx6f-382r-j72c
Remediation
- Fix · CNA CyberChef (gchq) Fixed in 11.2.0
- Fix · GHSA-fx6f-382r-j72c cyberchef (npm) Fixed in 11.2.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-57439
- 2026-10-03 Alias added: GHSA-fx6f-382r-j72c
References
Other 6
- https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c
- https://github.com/gchq/CyberChef/issues/2568
- https://github.com/gchq/CyberChef/pull/2569
- https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f
- https://github.com/gchq/CyberChef/releases/tag/v11.2.0
- https://github.com/gchq/CyberChef
More gchq vulnerabilities
- TI-2025-18851 Stroom Authentication/Authorization Bypass when using AWS ALB CVSS 3.1CRITICAL 9.4
- TI-2018-16004 Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser… CVSS 3.0CRITICAL 10.0
- TI-2026-30894 Cross-site scripting in gchq CyberChef CVSS 3.1HIGH 7.2
- TI-2019-11632 CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs. CVSS 3.0MEDIUM 6.1
- TI-2019-08044 Cross-site scripting in stroom:stroom-app CVSS 3.1MEDIUM 6.1
- TI-2026-51128 CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-57439 · CVE Program
- CVE-2026-57439 · NVD
- FIRST EPSS
- GHSA-fx6f-382r-j72c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences