Executive brief
GCHQ CyberChef, a popular web-based tool for data analysis and transformation, is vulnerable to a security flaw that could allow an attacker to execute malicious code in a user's browser. By tricking a user into clicking a specially crafted link containing a malicious 'recipe,' an attacker could potentially steal sensitive information or perform unauthorized actions on the user's behalf. This issue affects all versions prior to 11.0.0.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in GCHQ CyberChef versions prior to 11.0.0 within the 'Show Base64 offsets' operation. The root cause is the improper neutralization of user-controlled input (specifically the 'alphabet' parameter) which is rendered into the HTML output without sufficient escaping when 'showVariable' is set to false. An attacker can exploit this by crafting a malicious URL containing a script tag in the recipe parameters. When a victim loads this URL, the application's OutputWaiter component may evaluate the injected script, leading to arbitrary JavaScript execution in the context of the user's session. This has been patched in version 11.0.0 by ensuring the 'staticSection' variable is passed through the HTML escape utility.
Affected products
- GCHQ CyberChef < 11.0.0
Timeline
- 2026-04-28: disclosed: Issue reported on GitHub by OmriInbar-Novee
- 2026-04-28: patched: Fix merged into master branch and released in v11.0.0
- 2026-04-29: advisory: CVE-2026-42615 published