CVE-2026-57439

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f
https://github.com/gchq/CyberChef/issues/2568
https://github.com/gchq/CyberChef/pull/2569
https://github.com/gchq/CyberChef/releases/tag/v11.2.0
https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c
https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c

Configurations

No configuration.

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) CyberChef es una aplicación web para cifrado, codificación, compresión y análisis de datos. Antes de la versión 11.2.0, la operación Series Chart acepta ’__proto__’ como clave mientras analiza CSV proporcionado por el usuario, lo que permite la contaminación de prototipos que puede encadenarse con operaciones como Parse UDP para inyectar JavaScript malicioso en la salida HTML. Este problema está solucionado en la versión 11.2.0.

Information

Published : 2026-07-08 16:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-57439

Mitre link : CVE-2026-57439

CVE.ORG link : CVE-2026-57439

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-57439", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57439", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T16:12:11.872931Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gchq", "product": "CyberChef", "versions": [{"status": "affected", "version": "< 11.2.0"}]}]}], "published": "2026-07-08T16:16:31.280", "references": [{"url": "https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f", "source": "security-advisories@github.com"}, {"url": "https://github.com/gchq/CyberChef/issues/2568", "source": "security-advisories@github.com"}, {"url": "https://github.com/gchq/CyberChef/pull/2569", "source": "security-advisories@github.com"}, {"url": "https://github.com/gchq/CyberChef/releases/tag/v11.2.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c", "source": "security-advisories@github.com"}, {"url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0."}, {"lang": "es", "value": "CyberChef es una aplicaci\u00f3n web para cifrado, codificaci\u00f3n, compresi\u00f3n y an\u00e1lisis de datos. Antes de la versi\u00f3n 11.2.0, la operaci\u00f3n Series Chart acepta \u2019__proto__\u2019 como clave mientras analiza CSV proporcionado por el usuario, lo que permite la contaminaci\u00f3n de prototipos que puede encadenarse con operaciones como Parse UDP para inyectar JavaScript malicioso en la salida HTML. Este problema est\u00e1 solucionado en la versi\u00f3n 11.2.0."}], "lastModified": "2026-10-25T20:10:00.147", "sourceIdentifier": "security-advisories@github.com"}