CVE-2026-57439

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57439", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T13:21:20.729Z", "datePublished": "2026-07-08T14:58:38.693Z", "dateUpdated": "2026-07-08T16:12:28.118Z"}, "containers": {"cna": {"title": "CyberChef: Prototype pollution in Series Chart operation", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c"}, {"name": "https://github.com/gchq/CyberChef/issues/2568", "tags": ["x_refsource_MISC"], "url": "https://github.com/gchq/CyberChef/issues/2568"}, {"name": "https://github.com/gchq/CyberChef/pull/2569", "tags": ["x_refsource_MISC"], "url": "https://github.com/gchq/CyberChef/pull/2569"}, {"name": "https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f", "tags": ["x_refsource_MISC"], "url": "https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f"}, {"name": "https://github.com/gchq/CyberChef/releases/tag/v11.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/gchq/CyberChef/releases/tag/v11.2.0"}], "affected": [{"vendor": "gchq", "product": "CyberChef", "versions": [{"version": "< 11.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T14:58:38.693Z"}, "descriptions": [{"lang": "en", "value": "CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0."}], "source": {"advisory": "GHSA-fx6f-382r-j72c", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-08T16:12:11.872931Z", "id": "CVE-2026-57439", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T16:12:28.118Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57439", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T16:12:11.872931Z"}}}], "references": [{"url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T16:12:25.219Z"}}], "cna": {"title": "CyberChef: Prototype pollution in Series Chart operation", "source": {"advisory": "GHSA-fx6f-382r-j72c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "gchq", "product": "CyberChef", "versions": [{"status": "affected", "version": "< 11.2.0"}]}], "references": [{"url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c", "name": "https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gchq/CyberChef/issues/2568", "name": "https://github.com/gchq/CyberChef/issues/2568", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gchq/CyberChef/pull/2569", "name": "https://github.com/gchq/CyberChef/pull/2569", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f", "name": "https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gchq/CyberChef/releases/tag/v11.2.0", "name": "https://github.com/gchq/CyberChef/releases/tag/v11.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T14:58:38.693Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57439", "state": "PUBLISHED", "dateUpdated": "2026-07-08T16:12:28.118Z", "dateReserved": "2026-06-24T13:21:20.729Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T14:58:38.693Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "CyberChef", "vendor": "gchq", "versions": [{"status": "affected", "version": "< 11.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0."}, {"lang": "es", "value": "CyberChef es una aplicaci\u00f3n web para cifrado, codificaci\u00f3n, compresi\u00f3n y an\u00e1lisis de datos. Antes de la versi\u00f3n 11.2.0, la operaci\u00f3n Series Chart acepta \u2019__proto__\u2019 como clave mientras analiza CSV proporcionado por el usuario, lo que permite la contaminaci\u00f3n de prototipos que puede encadenarse con operaciones como Parse UDP para inyectar JavaScript malicioso en la salida HTML. Este problema est\u00e1 solucionado en la versi\u00f3n 11.2.0."}], "id": "CVE-2026-57439", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57439", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-08T16:12:11.872931Z", "version": "2.0.3"}}]}, "published": "2026-07-08T16:16:31.280", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f"}, {"source": "security-advisories@github.com", "url": "https://github.com/gchq/CyberChef/issues/2568"}, {"source": "security-advisories@github.com", "url": "https://github.com/gchq/CyberChef/pull/2569"}, {"source": "security-advisories@github.com", "url": "https://github.com/gchq/CyberChef/releases/tag/v11.2.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,11.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CyberChef", "source": "cna", "vendor": "gchq"}, "product": "cyberchef", "vendor": "gchq"}], "created": "2026-07-08T16:45:03.647512+00:00", "updated": "2026-08-01T16:15:07.340369+00:00", "vendors": ["gchq", "gchq$PRODUCT$cyberchef"]}