# CVE-2019-15532: CyberChef cross-site scripting in Text Encoding Brute Force

Source: https://junglewise.ai/threats/cve-2019-15532-cyberchef-cross-site-scripting-in-text-encoding-brute-force  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-15532 · Severity: low · CVSS 3 · Published 2019-08-27

CyberChef is a web-based toolkit used for encoding, decoding, and data transformation tasks. A cross-site scripting vulnerability in the Text Encoding Brute Force feature allows attackers to inject and execute arbitrary JavaScript code in a user's browser by crafting malicious input, potentially leading to session hijacking, credential theft, or malware distribution.

Technologies: [GCHQ CyberChef](https://junglewise.ai/threats/technologies/cyberchef). Vendors: [GCHQ](https://junglewise.ai/threats/vendors/gchq).

## Quick answers

**Is CVE-2019-15532 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-15532 being exploited in the wild.

**How severe is CVE-2019-15532?** Low severity, with a CVSS score of 3, published 27 August 2019.

**Which products and versions are affected?** GCHQ CyberChef prior to 8.31.3.

**Is there a fix for CVE-2019-15532?** A patch was published on 2019-08-27: Fixed in version 8.31.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-15532 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2019-15532?** Check whether you run GCHQ CyberChef at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the Text Encoding Brute Force functionality. The vulnerable component concatenates user-supplied input directly into HTML table rows without proper sanitization or escaping. An attacker can craft input containing JavaScript payloads (e.g., <script>alert('XSS')</script>) that execute in the victim's browser when processed by the feature. This requires user interaction (victim must use the affected feature with attacker-controlled input) over a network vector. The vulnerability was fixed in version 8.31.3; users should upgrade immediately.

## Affected products

- GCHQ CyberChef prior to 8.31.3

## Identifiers

- CVE-2019-15532
- GHSA-jp6r-xcjj-5h7r

## Timeline

- 2019-04-12: disclosed: Issue #539 reported on GitHub
- 2019-08-27: patched: Fixed in version 8.31.3
- 2019-08-27: advisory

## References

- [https://github.com/gchq/CyberChef/issues/539](https://github.com/gchq/CyberChef/issues/539)

## Related threats

- [GCHQ CyberChef prototype pollution in Series Chart operation](https://junglewise.ai/threats/cve-2026-57439-gchq-cyberchef-prototype-pollution-in-series-chart-operation)
- [GCHQ CyberChef XSS in Show Base64 offsets operation](https://junglewise.ai/threats/cve-2026-42615-gchq-cyberchef-xss-in-show-base64-offsets-operation)