CVE-2026-57439

5.0 Moyenne

Publiée le 08/07/2026 à 18:16 · Modifiée le 10/07/2026 à 19:56 · Analyse NVD reportée · Source : security-advisories@github.com

Description

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.

Traduire en français

Produits concernés

gchq CyberChef

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.0 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79
CWE-1321

Références

https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f
https://github.com/gchq/CyberChef/issues/2568
https://github.com/gchq/CyberChef/pull/2569
https://github.com/gchq/CyberChef/releases/tag/v11.2.0
https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c
https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories