cyfenced.com →

[ CVE-2026-57439 · Published 8 Jul 2026 ]

CyberChef: Prototype pollution in Series Chart operation

CVSS 5.0 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.

[ Fixes ]Fixes and patches

  • cyberchef 11.2.0Fixed version · GitHub Advisories · npm package cyberchef: upgrade to 11.2.0 or later (affected < 11.2.0)

[ Packages ]Affected open-source packages

[ References ]References