Is CVE-2026-42615 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42615 being exploited in the wild.

How severe is CVE-2026-42615?

High severity, with a CVSS score of 7.2, published 29 April 2026.

Which products and versions are affected?

GCHQ CyberChef < 11.0.0; cyberchef (npm) SEMVER:introduced=0,fixed=11.0.0.

Is there a fix for CVE-2026-42615?

Yes. cyberchef (npm): upgrade to 11.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42615 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-42615?

Check whether you run GCHQ CyberChef or cyberchef (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42615: GCHQ CyberChef XSS in Show Base64 offsets operation

Q: Which products and versions are affected?

GCHQ CyberChef < 11.0.0; cyberchef (npm) SEMVER:introduced=0,fixed=11.0.0.

Q: Is there a fix for CVE-2026-42615?

Yes. cyberchef (npm): upgrade to 11.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42615 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-42615?

Check whether you run GCHQ CyberChef or cyberchef (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42615 · Severity: high · CVSS 7.2 · Published 2026-04-29

GCHQ CyberChef, a popular web-based tool for data analysis and transformation, is vulnerable to a security flaw that could allow an attacker to execute malicious code in a user's browser. By tricking a user into clicking a specially crafted link containing a malicious 'recipe,' an attacker could potentially steal sensitive information or perform unauthorized actions on the user's behalf. This issue affects all versions prior to 11.0.0.

Technologies: GCHQ CyberChef. Vendors: GCHQ, npm.

Quick answers

Is CVE-2026-42615 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42615 being exploited in the wild.
How severe is CVE-2026-42615?: High severity, with a CVSS score of 7.2, published 29 April 2026.
Which products and versions are affected?: GCHQ CyberChef < 11.0.0; cyberchef (npm) SEMVER:introduced=0,fixed=11.0.0.
Is there a fix for CVE-2026-42615?: Yes. cyberchef (npm): upgrade to 11.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42615 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-42615?: Check whether you run GCHQ CyberChef or cyberchef (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

cyberchef (npm): upgrade to 11.0.0 or later
```
npm install cyberchef@11.0.0
```

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in GCHQ CyberChef versions prior to 11.0.0 within the 'Show Base64 offsets' operation. The root cause is the improper neutralization of user-controlled input (specifically the 'alphabet' parameter) which is rendered into the HTML output without sufficient escaping when 'showVariable' is set to false. An attacker can exploit this by crafting a malicious URL containing a script tag in the recipe parameters. When a victim loads this URL, the application's OutputWaiter component may evaluate the injected script, leading to arbitrary JavaScript execution in the context of the user's session. This has been patched in version 11.0.0 by ensuring the 'staticSection' variable is passed through the HTML escape utility.

Affected products

GCHQ CyberChef < 11.0.0

Identifiers

CVE-2026-42615
GHSA-h4hv-92pp-pcjg

Timeline

2026-04-28: disclosed: Issue reported on GitHub by OmriInbar-Novee
2026-04-28: patched: Fix merged into master branch and released in v11.0.0
2026-04-29: advisory: CVE-2026-42615 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.