Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-57439CyberChef: Prototype pollution in Series Chart operation

Medium 5.0

In plain English

A medium-severity cross-site scripting in CyberChef from gchq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.1%top 97.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	cyberchef	11.2.0	GHSA-fx6f-382r-j72c

Affected products (as reported)

Vendor	Product	Versions
gchq	CyberChef	< 11.2.0

Weakness: CWE-79, CWE-1321 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c x_refsource_CONFIRM
https://github.com/gchq/CyberChef/issues/2568 x_refsource_MISC
https://github.com/gchq/CyberChef/pull/2569 x_refsource_MISC
https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f x_refsource_MISC
https://github.com/gchq/CyberChef/releases/tag/v11.2.0 x_refsource_MISC