CVE-2026-42615: CyberChef Cross-site Scripting Vulnerability
Summary
CVE-2026-42615: CyberChef has a Cross-site Scripting issue. Affects cyberchef versions < 11.0.0. Fixed in 11.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CyberChef is a web application developed by GCHQ that provides a wide range of tools for data manipulation and analysis. It allows users to perform various operations on data, such as encoding, decoding, and transforming data formats. The application is widely used for its user-friendly interface and powerful features. However, prior to version 11.0.0, CyberChef was found to be vulnerable to a Cross-site Scripting (XSS) issue, which could potentially allow attackers to execute malicious scripts in the context of the user's browser.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the 'Show Base64 offsets' feature of CyberChef. An attacker could exploit this flaw by crafting a malicious payload that, when processed by the application, would execute arbitrary JavaScript code in the user's browser. This could lead to unauthorized actions being performed on behalf of the user, data theft, or session hijacking. The issue is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Latest published version: 11.5.0 as of 22 Oct 2026
npm install cyberchef@11.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.0
This is the first release that contains the fix.
npm install cyberchef@11.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, a temporary workaround is to avoid using the 'Show Base64 offsets' feature until the package is updated. Additionally, implementing Content Security Policy (CSP) headers can help mitigate the risk of XSS attacks.
Conclusion
In summary, the CyberChef application is affected by a Cross-site Scripting vulnerability that can be exploited if not addressed. Users are strongly advised to update to version 11.0.0 or later to mitigate this risk. For those unable to update immediately, implementing CSP headers can provide temporary protection.
See every vulnerability recorded for cyberchef →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft or unauthorized actions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to user data, session hijacking, or execution of malicious actions in the context of the user's session.
Yes, you can implement Content Security Policy (CSP) headers to reduce the risk of XSS attacks while you work on updating the package.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for cyberchef.
