GHSA-FX6F-382R-J72C

Vulnerability from github – Published: 2026-09-24 19:24 – Updated: 2026-09-24 19:24
VLAI
Summary
CyberChef: Prototype pollution in Series Chart operation
Details

On 5 June 2026 CyberChef received a security vulnerability report from @hyuunnn detailing a vulnerability in the Series Chart operation, where malicious input could result in prototype pollution of the data structures outputted from the operation. Other operations following Series Chart could have their behaviour manipulated by the attacker-controlled prototype, for example, injecting malicious content into their HTML output.

In this case, a demonstration was provided that chained the Series Chart operation with the Parse UDP operation to cause attacker controlled JavaScript to be executed.

Details

When the Series Chart operation parses user-supplied CSV, it accepts __proto__ as a key and uses it to pollute the object. The objToTbale function in src/core/lib/Protocol.mjs, used in a number of IP parsing operations, renders data items within <td> tags without escaping. These bugs can be chained to produce an XSS vulnerability.

Proof of Concept https://gchq.github.io/CyberChef/#recipe=Series_chart('CRLF','Comma','',1,'')Parse_UDP('Raw')&input=X19wcm90b19fLDxpbWcgc3JjPXggb25lcnJvcj1hbGVydChkb2N1bWVudC5kb21haW4pPiwxParse_UDP('Raw')&input=X19wcm90b19fLDxpbWcgc3JjPXggb25lcnJvcj1hbGVydChkb2N1bWVudC5kb21haW4pPiwx)

Encoded input data is:

__proto__,<img src=x onerror=alert(document.domain)>,1

Impact

Objects with attacker controlled prototypes could be processed by CyberChef operations. This enabled control of the output of some operations, and in particular, the ability to insert malicious JavaScript into the output of the Parse UDP operation.

Patches

This has been patched in release v11.2.0.

Workarounds

No workarounds are available. Users must upgrade to CyberChef v11.2.0.

Severity
5.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "cyberchef"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-24T19:24:30Z",
    "nvd_published_at": "2026-07-08T16:16:31Z",
    "severity": "MODERATE"
  },
  "details": "On 5 June 2026 CyberChef received a security vulnerability report from @hyuunnn detailing a vulnerability in the Series Chart operation, where malicious input could result in prototype pollution of the data structures outputted from the operation.\nOther operations following Series Chart could have their behaviour manipulated by the attacker-controlled prototype, for example, injecting malicious content into their HTML output.\n\nIn this case, a demonstration was provided that chained the Series Chart operation with the Parse UDP operation to cause attacker controlled JavaScript to be executed.\n\n## Details\nWhen the Series Chart operation parses user-supplied CSV, it accepts `__proto__` as a key and uses it to pollute the object.\nThe objToTbale function in src/core/lib/Protocol.mjs, used in a number of IP parsing operations, renders data items within `\u003ctd\u003e` tags without escaping.\nThese bugs can be chained to produce an XSS vulnerability.\n\n**Proof of Concept**\n[https://gchq.github.io/CyberChef/#recipe=Series_chart(\u0027CRLF\u0027,\u0027Comma\u0027,\u0027\u0027,1,\u0027\u0027)Parse_UDP(\u0027Raw\u0027)\u0026input=X19wcm90b19fLDxpbWcgc3JjPXggb25lcnJvcj1hbGVydChkb2N1bWVudC5kb21haW4pPiwx](https://gchq.github.io/CyberChef/#recipe=Series_chart(\u0027CRLF\u0027,\u0027Comma\u0027,\u0027\u0027,1,\u0027\u0027)Parse_UDP(\u0027Raw\u0027)\u0026input=X19wcm90b19fLDxpbWcgc3JjPXggb25lcnJvcj1hbGVydChkb2N1bWVudC5kb21haW4pPiwx)\n\nEncoded input data is:\n```\n__proto__,\u003cimg src=x onerror=alert(document.domain)\u003e,1\n```\n\n### Impact\nObjects with attacker controlled prototypes could be processed by CyberChef operations. This enabled control of the output of some operations, and in particular, the ability to insert malicious JavaScript into the output of the Parse UDP operation.\n\n### Patches\nThis has been patched in release v11.2.0.\n\n### Workarounds\nNo workarounds are available. Users must upgrade to CyberChef v11.2.0.",
  "id": "GHSA-fx6f-382r-j72c",
  "modified": "2026-09-24T19:24:30Z",
  "published": "2026-09-24T19:24:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57439"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gchq/CyberChef/issues/2568"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gchq/CyberChef/pull/2569"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gchq/CyberChef"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gchq/CyberChef/releases/tag/v11.2.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CyberChef: Prototype pollution in Series Chart operation"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.