{"id":"EUVD-2026-42294","enisaUuid":"c51fcb9a-0ec5-3321-9f13-51671bf7dfe4","description":"CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.","datePublished":"Jul 8, 2026, 2:58:38 PM","dateUpdated":"Jul 8, 2026, 4:12:28 PM","baseScore":5.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c\nhttps://github.com/gchq/CyberChef/issues/2568\nhttps://github.com/gchq/CyberChef/pull/2569\nhttps://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f\nhttps://github.com/gchq/CyberChef/releases/tag/v11.2.0\n","aliases":"CVE-2026-57439\nGHSA-fx6f-382r-j72c\n","assigner":"GitHub_M","epss":0.14,"enisaIdProduct":[{"id":"2d040b60-4121-3051-802d-6d5ba51b89e6","product":{"name":"CyberChef","vendor":{"name":"gchq"}},"product_version":"\u003c 11.2.0"}],"enisaIdVendor":[{"id":"ee6181ba-1868-3f6d-ae69-02460cf79980","vendor":{"name":"gchq"}}],"enisaIdVulnerability":[{"id":"86c331c1-69be-3187-88df-2f27d45e7d74","vulnerability":{"id":"GHSA-fx6f-382r-j72c","description":"CyberChef: Prototype pollution in Series Chart operation","datePublished":"Sep 24, 2026, 7:24:30 PM","dateUpdated":"Sep 24, 2026, 7:24:30 PM","baseScore":0.0,"references":"https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57439\nhttps://github.com/gchq/CyberChef/issues/2568\nhttps://github.com/gchq/CyberChef/pull/2569\nhttps://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f\nhttps://github.com/gchq/CyberChef\nhttps://github.com/gchq/CyberChef/releases/tag/v11.2.0\n","enisa_id":"EUVD-2026-42294\n","aliases":"CVE-2026-57439\nGHSA-fx6f-382r-j72c\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a68027c3-9503-36ff-a80b-901b313a5700","vulnerability":{"id":"CVE-2026-57439","description":"CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.","datePublished":"Jul 8, 2026, 2:58:38 PM","dateUpdated":"Jul 8, 2026, 4:12:28 PM","status":"PUBLISHED","baseScore":5.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c\nhttps://github.com/gchq/CyberChef/issues/2568\nhttps://github.com/gchq/CyberChef/pull/2569\nhttps://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f\nhttps://github.com/gchq/CyberChef/releases/tag/v11.2.0\n","enisa_id":"EUVD-2026-42294\n","assigner":"GitHub_M","epss":0.14,"dataProcessed":"Oct 30, 2026, 7:16:53 AM","vulnerabilityProduct":[{"id":"c3e35a94-a857-32d1-b164-22d135be2492","product":{"name":"CyberChef","vendor":{"name":"gchq"}},"product_version":"\u003c 11.2.0"}],"vulnerabilityVendor":[{"id":"06032d9f-5358-368c-9f75-9eaea69e99f9","vendor":{"name":"gchq"}}]}}],"enisaIdAdvisory":[]}