CVE-2026-57439CWE-1321CWE-79

CyberChef: Prototype pollution in Series Chart operation

Medium · published July 8, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00244 · 14.7th percentile
Weaknesses
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-08T14:58Z
EPSS history
Timeline
  • 08 JUL 14:58Z
    CyberChef: Prototype pollution in Series Chart operation
    cvelistv5