CVE-2026-57439: CyberChef Prototype Pollution in Series Chart Operation
Summary
CVE-2026-57439: CyberChef: Prototype pollution in Series Chart operation. Affects cyberchef versions < 11.2.0. Fixed in 11.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CyberChef is a web application designed for data transformation and analysis, allowing users to perform various operations on data such as encoding, decoding, and visualizing. One of its key features is the Series Chart operation, which enables users to create visual representations of data from CSV inputs. However, this operation is vulnerable to prototype pollution, which can lead to severe security implications.
Vulnerability Detail
The vulnerability arises from the Series Chart operation's handling of user-supplied CSV data, where it accepts 'proto' as a key. This allows an attacker to manipulate the prototype of objects, leading to potential XSS (Cross-Site Scripting) vulnerabilities. By chaining the Series Chart operation with the Parse UDP operation, an attacker can execute malicious JavaScript, compromising the integrity of the application and potentially exposing sensitive user data.
How To Fix
Latest published version: 11.5.0 as of 22 Oct 2026
npm install cyberchef@11.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.2.0
This is the first release that contains the fix.
npm install cyberchef@11.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workarounds are available for this vulnerability. Users must upgrade to CyberChef v11.2.0 to mitigate the risk.
Conclusion
The CVE-2026-57439 vulnerability in CyberChef's Series Chart operation poses a significant risk due to its potential for prototype pollution and XSS attacks. Users are strongly advised to upgrade to version 11.2.0 to secure their applications against this threat.
See every vulnerability recorded for cyberchef →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of an object in JavaScript, potentially leading to unexpected behavior or security issues.
This vulnerability allows attackers to inject malicious JavaScript into the output of CyberChef operations, which can lead to XSS attacks and compromise user data.
If you are using a version of CyberChef prior to 11.2.0, you should upgrade immediately to mitigate the vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can also check your application using the Vulert playground.
The CVSS score for this vulnerability is 5.0, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for cyberchef.
