{"id":"CVE-2026-57439","sourceIdentifier":"security-advisories@github.com","published":"2026-07-08T16:16:31.280","lastModified":"2026-07-10T17:56:00.910","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"gchq","product":"CyberChef","versions":[{"version":"< 11.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-08T16:12:11.872931Z","id":"CVE-2026-57439","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f","source":"security-advisories@github.com"},{"url":"https://github.com/gchq/CyberChef/issues/2568","source":"security-advisories@github.com"},{"url":"https://github.com/gchq/CyberChef/pull/2569","source":"security-advisories@github.com"},{"url":"https://github.com/gchq/CyberChef/releases/tag/v11.2.0","source":"security-advisories@github.com"},{"url":"https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c","source":"security-advisories@github.com"},{"url":"https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}