Approved changes feed: RSS · Atom
cpe:2.3:a:gchq:cyberchef:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Gchq (f6387987-e144-5763-82a0-1627318af1f0) |
|---|---|
| Product | Cyberchef (4b5d5372-2b41-5cb5-a184-4eec4aa44ba9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:bitbucket/marcelraschke/cyberchef |
purl2cpe | 2026-06-01 10:15:32.161857 |
pkg:docker/mpepping/cyberchef |
purl2cpe | 2026-06-01 10:15:32.161859 |
pkg:github/gchq/cyberchef |
purl2cpe | 2026-06-01 10:15:32.161862 |
pkg:npm/cyberchef |
purl2cpe | 2026-06-01 10:15:32.161865 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-72912 |
vulnerable | 2026-09-16 04:33:09.094299 |
CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL
MEDIUM (4.3)
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0.
Published: 2026-08-10T21:02:16.375Z
Updated: 2026-08-12T22:14:24.757Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57439 |
vulnerable | 2026-07-29 01:00:29.813021 |
CyberChef: Prototype pollution in Series Chart operation
MEDIUM (5)
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.
Published: 2026-07-08T14:58:38.693Z
Updated: 2026-07-08T16:12:28.118Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42615 |
vulnerable | 2026-06-08 08:03:16.571969 |
Details available
HIGH (7.2)
GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.
Published: 2026-04-29T02:55:53.171Z
Updated: 2026-04-29T13:14:40.068Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-15532 |
vulnerable | 2026-06-08 05:12:57.540798 |
Details available
CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs.
Published: 2019-08-26T11:45:10.000Z
Updated: 2024-08-05T00:49:13.715Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.