CVE-2026-57439

Name of the Vulnerable Software and Affected Versions CyberChef versions prior to 11.2.0

Description The Series Chart operation allows prototype pollution when parsing user-supplied CSV data because it accepts proto as a key. Prototype pollution is a technique where an attacker manipulates the prototype of an object to change the behavior of the application. This flaw can be combined with other operations, such as Parse UDP, to inject malicious JavaScript into the HTML output.

Recommendations Update to version 11.2.0.