Gchq
Monthly
Cross-site scripting in GCHQ CyberChef before 11.0.0 allows attackers to execute arbitrary JavaScript in a victim's browser via the 'Show Base64 offsets' operation, which rendered attacker-influenced input into the HTML output without escaping. A crafted recipe URL (e.g. /#recipe=Show_Base64_offsets('<script...')) triggers script execution in the CyberChef page context. No public exploit is identified beyond the demonstrative payload in the advisory; EPSS is negligible (0.01%) and the flaw is not automatable per CISA SSVC, though a fix is confirmed in v11.0.0.
Prototype pollution in CyberChef prior to 11.2.0 enables cross-site scripting via a chained operation attack. The Series Chart operation accepts `__proto__` as a valid CSV key without sanitization, corrupting the JavaScript Object prototype; when downstream operations such as Parse UDP generate HTML output, the polluted prototype injects attacker-controlled JavaScript that executes in the victim's browser. The vendor has released a fix in version 11.2.0; no public exploit and no CISA KEV listing have been identified at time of analysis.
CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting in GCHQ CyberChef before 11.0.0 allows attackers to execute arbitrary JavaScript in a victim's browser via the 'Show Base64 offsets' operation, which rendered attacker-influenced input into the HTML output without escaping. A crafted recipe URL (e.g. /#recipe=Show_Base64_offsets('<script...')) triggers script execution in the CyberChef page context. No public exploit is identified beyond the demonstrative payload in the advisory; EPSS is negligible (0.01%) and the flaw is not automatable per CISA SSVC, though a fix is confirmed in v11.0.0.
Prototype pollution in CyberChef prior to 11.2.0 enables cross-site scripting via a chained operation attack. The Series Chart operation accepts `__proto__` as a valid CSV key without sanitization, corrupting the JavaScript Object prototype; when downstream operations such as Parse UDP generate HTML output, the polluted prototype injects attacker-controlled JavaScript that executes in the victim's browser. The vendor has released a fix in version 11.2.0; no public exploit and no CISA KEV listing have been identified at time of analysis.
CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.