Cross-Site Scripting (XSS) in cyberchef (CVE-2026-57439)
Summary
Cross-site scripting in cyberchef (CVE-2026-57439). Risk of unauthorized operations or information disclosure. Exploitable via __proto__. Mitigation: upgrade to 11.2.0 or later.
Original description
The description as published by the source.
On 5 June 2026 CyberChef received a security vulnerability report from @hyuunnn detailing a vulnerability in the Series Chart operation, where malicious input could result in prototype pollution of the data structures outputted from the operation.
Other operations following Series Chart could have their behaviour manipulated by the attacker-controlled prototype, for example, injecting malicious content into their HTML output.
In this case, a demonstration was provided that chained the Series Chart operation with the Parse UDP operation to cause attacker controlled JavaScript to be executed.
Details
When the Series Chart operation parses user-supplied CSV, it accepts __proto__ as a key and uses it to pollute the object.
The objToTbale function in src/core/lib/Protocol.mjs, used in a number of IP parsing operations, renders data items within `` tags without escaping.
These bugs can be chained to produce an XSS vulnerability.
Encoded input data is:
__proto__,,1
Impact
Objects with attacker controlled prototypes could be processed by CyberChef operations. This enabled control of the output of so…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-57439 has been found in cyberchef.
Attackers can target a specific entry point like __proto__ over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 5.0/10.
What to do: upgrade cyberchef to 11.2.0 or later.
If unsure, ask your IT team or search "cyberchef CVE-2026-57439" on the vendor's site.
CVE-2026-57439 (cyberchef) — CWE-79 / CVSS v3 5.0
Attack vector: local / unauthenticated
Attack surface: __proto__
Patched: 11.2.0 — apply immediately
Workaround: No workarounds are available.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Cross-site scripting (XSS) (CWE-79) exists in cyberchef. Attackers reach the vulnerable code path via __proto__ without authentication.
Check the vendor advisory for the affected versions of cyberchef. Attack surface: __proto__.
Severity: Medium (CVSS 5.0/10). Risk of unauthorized operations or information disclosure.
Update to 11.2.0.
Workaround: No workarounds are available.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'cyberchef' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'cyberchef' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
cyberchefを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
No workarounds are available.パッチが適用されるまでの応急処置として、No workarounds are available. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Apply patch patch
Upgrade cyberchef to 11.2.0ステージング環境で 11.2.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web nvd.nist.gov
- web github.com