CVE-2026-57439

MEDIUM 5.0

CyberChef: Prototype pollution in Series Chart operation

CVSS Score

5.0

EPSS Score

0.0%

EPSS Percentile

0th

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.

CWE	CWE-79 CWE-1321
Vendor	gchq
Product	cyberchef
Published	Jul 8, 2026
Last Updated	Jul 8, 2026

Stay Ahead of the Next One

Get instant alerts for gchq cyberchef

Be the first to know when new medium vulnerabilities affecting gchq cyberchef are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

gchq / CyberChef

< 11.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c github.com: https://github.com/gchq/CyberChef/issues/2568 github.com: https://github.com/gchq/CyberChef/pull/2569 github.com: https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f github.com: https://github.com/gchq/CyberChef/releases/tag/v11.2.0