CVE-2026-57439 | THREATINT

Description

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.

PUBLISHED Reserved 2026-06-24 | Published 2026-07-08 | Updated 2026-07-08 | Assigner GitHub_M

MEDIUM: 5.0CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Product status

< 11.2.0

affected

References

github.com/...erChef/security/advisories/GHSA-fx6f-382r-j72c exploit

github.com/...erChef/security/advisories/GHSA-fx6f-382r-j72c

github.com/gchq/CyberChef/issues/2568

github.com/gchq/CyberChef/pull/2569

github.com/...ommit/85db3be5d0096859b810f0e8d3e151d5dc9b948f

github.com/gchq/CyberChef/releases/tag/v11.2.0

cve.org (CVE-2026-57439)

nvd.nist.gov (CVE-2026-57439)

Download JSON