CVE-2026-57439: CyberChef XSS Vulnerability

CVE-2026-57439 Overview

CVE-2026-57439 is a prototype pollution vulnerability in CyberChef, the popular web application for encryption, encoding, compression, and data analysis maintained by GCHQ. Versions prior to 11.2.0 allow the Series Chart operation to accept __proto__ as a key while parsing user-supplied CSV data. When chained with other operations such as Parse UDP, this pollution can be leveraged to inject malicious JavaScript into HTML output, resulting in cross-site scripting [CWE-79]. The issue is fixed in CyberChef version 11.2.0.

Critical Impact
An attacker can craft CSV input that pollutes the JavaScript Object.prototype, enabling script injection into rendered HTML output when combined with operations like Parse UDP.

Affected Products

GCHQ CyberChef versions prior to 11.2.0
Any deployment relying on the Series Chart operation for user-supplied CSV parsing
Self-hosted CyberChef instances processing untrusted recipes or inputs

Discovery Timeline

2026-07-08 - CVE-2026-57439 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-57439

Vulnerability Analysis

The vulnerability resides in CyberChef's Series Chart operation, implemented in src/core/lib/Charts.mjs. The operation constructs a plain JavaScript object (const series = {}) to accumulate series data parsed from user-supplied CSV input. Because plain objects inherit from Object.prototype, assigning a value to the key __proto__ mutates the prototype chain for all objects in the JavaScript runtime.

An attacker crafts CSV rows where the first column is __proto__, causing arbitrary properties to be written to Object.prototype. When the polluted state is later consumed by an operation such as Parse UDP, which renders parsed fields into an HTML table without treating inherited properties as untrusted, attacker-controlled data reaches the DOM and executes as JavaScript.

Root Cause

The root cause is unsafe handling of user-controlled object keys during CSV-to-object conversion. The Series Chart code did not filter or reject dangerous keys such as __proto__, constructor, or prototype, and it used a prototype-inheriting object as the accumulator. The downstream HTML rendering in Protocol.mjs did not sanitize inherited properties, completing the injection chain.

Attack Vector

Exploitation requires user interaction: a victim must load a CyberChef recipe that chains Series Chart with a rendering operation like Parse UDP and process attacker-supplied input. This typically occurs via a shared recipe link or copied CSV payload. The attack vector is local with low complexity, and successful exploitation leads to script execution in the victim's browser context.

text

// Security patch in src/core/lib/Charts.mjs (from PR #2569)
     );
 
     let xValues = new Set();
-    const series = {};
+    const series = Object.create(null);
 
     values.forEach(row => {
         const serie = row[0],

Source: GitHub Commit 85db3be

The fix replaces the prototype-inheriting {} accumulator with Object.create(null), producing an object with no prototype chain. Writes to __proto__ become ordinary own-property assignments and cannot pollute Object.prototype.

text

// Security patch in src/core/lib/Protocol.mjs (from PR #2569)
 
 import BigNumber from "bignumber.js";
 import {toHexFast} from "../lib/Hex.mjs";
+import Utils from "../Utils.mjs";
 
 /**
  * Recursively displays a JSON object as an HTML table

Source: GitHub Commit 85db3be

The companion change in Protocol.mjs imports Utils to properly escape values before they are inserted into the HTML table rendered by Parse UDP and similar operations.

Detection Methods for CVE-2026-57439

Indicators of Compromise

CyberChef recipes or shared URLs that combine the Series Chart operation with Parse UDP or other HTML-rendering operations
CSV input rows where the first field contains the literal string __proto__, constructor, or prototype
Unexpected <script> tags or inline event handlers appearing in CyberChef HTML output panes

Detection Strategies

Inventory hosted or embedded CyberChef instances and identify versions below 11.2.0
Inspect saved recipes and shared links for Series_Chart chained with rendering operations processing untrusted input
Monitor web proxy logs for CyberChef recipe URLs containing encoded __proto__ payloads

Monitoring Recommendations

Enable Content Security Policy (CSP) headers on self-hosted CyberChef deployments to block inline script execution
Log and alert on outbound requests from browsers viewing CyberChef output that reach unexpected external domains
Review browser console errors for prototype-related exceptions on pages hosting CyberChef

How to Mitigate CVE-2026-57439

Immediate Actions Required

Upgrade all CyberChef deployments to version 11.2.0 or later, published in the GitHub Release v11.2.0
Audit shared recipes and disable public sharing until users are on the patched version
Warn users against loading untrusted CyberChef recipes or CSV inputs from external sources

Patch Information

The fix is delivered in CyberChef 11.2.0 via Pull Request #2569 and commit 85db3be5d0096859b810f0e8d3e151d5dc9b948f. See the GHSA-fx6f-382r-j72c security advisory and the GitHub Issue Tracker entry #2568 for full context.

Workarounds

Avoid using the Series Chart operation on untrusted CSV input until the upgrade is complete
Serve self-hosted CyberChef behind a strict Content Security Policy that forbids inline scripts and restricts script sources
Isolate CyberChef in a dedicated browser profile or sandboxed origin to limit the impact of any successful script injection

bash

# Upgrade a self-hosted CyberChef deployment to the patched release
git clone https://github.com/gchq/CyberChef.git
cd CyberChef
git checkout v11.2.0
npm ci
npm run build