Skip to content
OpenAdvisories
High · 7.2 CVE-2026-42615 EUVD-2026-26191GHSA-h4hv-92pp-pcjg

CyberChef has a Cross-site Scripting issue

Published Apr 29, 2026 · Updated Apr 29, 2026 · Assigned by mitre

Vendor: GCHQ Product: CyberChef Package: cyberchef Ecosystem: npm

Description

GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.

Affected products

VendorProductAffectedFixed
GCHQ CyberChef < 11.0.0 11.0.0

Affected packages

EcosystemPackageAffectedFixedRecord
npm cyberchef < 11.0.0 11.0.0 GHSA-h4hv-92pp-pcjg

References