EUVD-2026-55834Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Network-delivered URL requires user interaction; no auth, no scope change; only availability impact is a transient browser tab freeze.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0.
AnalysisAI
CyberChef's client-side pretty-recipe parser freezes victim browser tabs via a crafted URL fragment containing large numbers of unmatched quote characters, triggering catastrophic backtracking in a synchronous global regular expression. Any user of CyberChef prior to 11.3.0 who opens a malicious #recipe= URL - whether shared in phishing, chat, or embedded in a page - is subject to a temporary denial-of-service condition. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a victim user open a specifically crafted CyberChef URL containing a malformed #recipe= URL fragment with a large number of unmatched single-quote characters. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 score and AV:N/AC:L/PR:N/UI:R vector accurately reflect the attack surface: any CyberChef user who opens a crafted URL is affected, but user interaction (UI:R) is a meaningful friction point. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker constructs a CyberChef URL with a #recipe= fragment containing thousands of consecutive unmatched single-quote characters (e.g., CyberChef/#recipe='''''....) and shares it via phishing email, Slack, or a malicious web page. When a security analyst clicks the link, their browser tab running CyberChef freezes during startup as the JavaScript engine exhaustively backtracks through the malformed input, disrupting their workflow for seconds or longer until the tab is manually killed. … |
| Remediation | The primary fix is to upgrade CyberChef to version 11.3.0 or later, which is confirmed available at https://github.com/gchq/CyberChef/releases/tag/v11.3.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today