EUVD-2026-26191
GHSA-h4hv-92pp-pcjg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Reflected XSS delivered via a crafted recipe URL requires the victim to open it, so UI:R; no auth (PR:N), browser-context script execution changes scope (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
6DescriptionCVE.org
GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.
AnalysisAI
Cross-site scripting in GCHQ CyberChef before 11.0.0 allows attackers to execute arbitrary JavaScript in a victim's browser via the 'Show Base64 offsets' operation, which rendered attacker-influenced input into the HTML output without escaping. A crafted recipe URL (e.g. /#recipe=Show_Base64_offsets('<script...')) triggers script execution in the CyberChef page context. No public exploit is identified beyond the demonstrative payload in the advisory; EPSS is negligible (0.01%) and the flaw is not automatable per CISA SSVC, though a fix is confirmed in v11.0.0.
Technical ContextAI
CyberChef is a browser-based, client-side data-transformation web application ('the Cyber Swiss Army Knife') developed by GCHQ, widely used by analysts to encode, decode, and inspect data. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the ShowBase64Offsets.mjs operation concatenated substrings of the input directly into HTML markup (inside <span> highlight tags) without HTML-encoding. The vendor fix wraps each interpolated segment (staticSection and the offset0/offset1/offset2 substrings) in Utils.escapeHtml(), neutralizing angle brackets so payloads like <script> are rendered as inert text (<script>) rather than parsed as markup. The CPE cpe:2.3:a:gchq:cyberchef:*:*:*:*:*:*:*:* confirms the affected application is the GCHQ CyberChef codebase across all versions prior to the fix.
RemediationAI
Vendor-released patch: upgrade to CyberChef 11.0.0 or later, which HTML-escapes the 'Show Base64 offsets' output via Utils.escapeHtml() (fix commit 9641ae07f92e9af50f10e978385465b2f4a36c4d, PR #2346). Operators of self-hosted CyberChef instances should redeploy the updated build; users of the public instance are covered once GCHQ updates it. If you cannot upgrade immediately, avoid running the 'Show Base64 offsets' operation on untrusted input and do not open CyberChef recipe links (/#recipe=...) received from untrusted sources, since the payload rides in the URL fragment; on hosted deployments, adding a restrictive Content-Security-Policy that forbids inline script execution meaningfully reduces impact but may break some CyberChef functionality that relies on dynamic script/eval behavior, so test before enforcing. Reference advisories: https://github.com/gchq/CyberChef/issues/2344 and https://vuldb.com/vuln/360096.
CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs. Rated medium severity (CVSS 6.1), this
Prototype pollution in CyberChef prior to 11.2.0 enables cross-site scripting via a chained operation attack. The Series
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today