Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
On 5 June 2026 CyberChef received a security vulnerability report from @hyuunnn detailing a vulnerability in the Series Chart operation, where malicious input could result in prototype pollution of the data structures outputted from the operation. Other operations following Series Chart could have their behaviour manipulated by the attacker-controlled prototype, for example, injecting malicious content into their HTML output. In this case, a demonstration was provided that chained the Series Chart operation with the Parse UDP operation to cause attacker controlled JavaScript to be executed. Details When the Series Chart operation parses user-supplied CSV, it accepts proto as a key and uses it to pollute the object. The objToTbale function in src/core/lib/Protocol.mjs, used in a number of IP parsing operations, renders data items within <td tags without escaping. These bugs can be chained to produce an XSS vulnerability. Proof of Concept…
Recommended action: Upgrade to 11.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=ShowBase64offsets('%3Cscript substring.
Recommended action: Upgrade to 11.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of cyberchef prior to 8.31.3 are vulnerable to Cross-Site Scripting. In Text Encoding Brute Force the table rows are created by concatenating the value variable unsanitized in the HTML code. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 8.31.3 or later.
Recommended action: Upgrade to 8.31.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.