CVE-2026-57439: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in gchq CyberChef
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.
AI Analysis
Technical Summary
CyberChef versions before 11.2.0 contain a vulnerability in the Series Chart operation where the __proto__ key is accepted during CSV parsing. This allows prototype pollution, which can be exploited in combination with other operations such as Parse UDP to inject malicious JavaScript into the generated HTML output. This constitutes a cross-site scripting (CWE-79) vulnerability. The vulnerability is resolved in version 11.2.0.
Potential Impact
An attacker who can supply specially crafted CSV input to the Series Chart operation can cause prototype pollution, leading to the injection of malicious JavaScript into the HTML output. This can result in cross-site scripting attacks, potentially compromising confidentiality and integrity of user data within the affected application context. The CVSS score is 5.0 (medium), reflecting limited attack vector (local), low complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity without availability impact.
Mitigation Recommendations
Upgrade CyberChef to version 11.2.0 or later, where this vulnerability is fixed. No official patch or temporary fix is indicated beyond this version upgrade. Users should avoid using vulnerable versions for processing untrusted CSV input with the Series Chart operation.
CVE-2026-57439: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in gchq CyberChef
Description
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.
CVSS v3.1
Score 5.0medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CyberChef versions before 11.2.0 contain a vulnerability in the Series Chart operation where the __proto__ key is accepted during CSV parsing. This allows prototype pollution, which can be exploited in combination with other operations such as Parse UDP to inject malicious JavaScript into the generated HTML output. This constitutes a cross-site scripting (CWE-79) vulnerability. The vulnerability is resolved in version 11.2.0.
Potential Impact
An attacker who can supply specially crafted CSV input to the Series Chart operation can cause prototype pollution, leading to the injection of malicious JavaScript into the HTML output. This can result in cross-site scripting attacks, potentially compromising confidentiality and integrity of user data within the affected application context. The CVSS score is 5.0 (medium), reflecting limited attack vector (local), low complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity without availability impact.
Mitigation Recommendations
Upgrade CyberChef to version 11.2.0 or later, where this vulnerability is fixed. No official patch or temporary fix is indicated beyond this version upgrade. Users should avoid using vulnerable versions for processing untrusted CSV input with the Series Chart operation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-24T13:21:20.729Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4e73c0c9d9e3dbe360428e
Added to database: 07/08/2026, 15:58:56 UTC
Last enriched: 07/08/2026, 16:14:41 UTC
Last updated: 07/09/2026, 01:37:16 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.