{"id":"CVE-2026-57439","aliases":["GHSA-fx6f-382r-j72c"],"title":"CyberChef: Prototype pollution in Series Chart operation","summary":"CyberChef: Prototype pollution in Series Chart operation","severity":"medium","cvss":5,"cwe":["CWE-79","CWE-1321"],"vendor":"cyberchef","product":"cyberchef","ecosystem":"npm","affected":["cyberchef < 11.2.0"],"patched":["cyberchef 11.2.0"],"published":"2026-09-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T19:24:31Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-fx6f-382r-j72c","references":[{"url":"https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57439"},{"url":"https://github.com/gchq/CyberChef/issues/2568"},{"url":"https://github.com/gchq/CyberChef/pull/2569"},{"url":"https://github.com/gchq/CyberChef/commit/85db3be5d0096859b810f0e8d3e151d5dc9b948f"},{"url":"https://github.com/gchq/CyberChef/releases/tag/v11.2.0"},{"url":"https://github.com/advisories/GHSA-fx6f-382r-j72c"}],"tags":["ghsa","npm"],"epss":0.00244,"epssPercentile":0.13845,"ingestedAt":"2026-09-24T19:50:30.722Z","slug":"CVE-2026-57439","body":"## Overview\n\nOn 5 June 2026 CyberChef received a security vulnerability report from @hyuunnn detailing a vulnerability in the Series Chart operation, where malicious input could result in prototype pollution of the data structures outputted from the operation.\nOther operations following Series Chart could have their behaviour manipulated by the attacker-controlled prototype, for example, injecting malicious content into their HTML output.\n\nIn this case, a demonstration was provided that chained the Series Chart operation with the Parse UDP operation to cause attacker controlled JavaScript to be executed.\n\n## Details\nWhen the Series Chart operation parses user-supplied CSV, it accepts `__proto__` as a key and uses it to pollute the object.\nThe objToTbale function in src/core/lib/Protocol.mjs, used in a number of IP parsing operations, renders data items within `<td>` tags without escaping.\nThese bugs can be chained to produce an XSS vulnerability.\n\n**Proof of Concept**\n[https://gchq.github.io/CyberChef/#recipe=Series_chart('CRLF','Comma','',1,'')Parse_UDP('Raw')&input=X19wcm90b19fLDxpbWcgc3JjPXggb25lcnJvcj1hbGVydChkb2N1bWVudC5kb21haW4pPiwx](https://gchq.github.io/CyberChef/#recipe=Series_chart('CRLF','Comma','',1,'')Parse_UDP('Raw')&input=X19wcm90b19fLDxpbWcgc3JjPXggb25lcnJvcj1hbGVydChkb2N1bWVudC5kb21haW4pPiwx)\n\nEncoded input data is:\n```\n__proto__,<img src=x onerror=alert(document.domain)>,1\n```\n\n### Impact\nObjects with attacker controlled prototypes could be processed by CyberChef operations. This enabled control of the output of some operations, and in particular, the ability to insert malicious JavaScript into the output of the Parse UDP operation.\n\n### Patches\nThis has been patched in release v11.2.0.\n\n### Workarounds\nNo workarounds are available. Users must upgrade to CyberChef v11.2.0.\n\n## Affected packages\n\n- `cyberchef < 11.2.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `cyberchef 11.2.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}