Is CVE-2026-57439 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57439 being exploited in the wild.

How severe is CVE-2026-57439?

Medium severity, with a CVSS score of 5, published 8 July 2026.

Which products and versions are affected?

GCHQ CyberChef < 11.2.0; cyberchef (npm) SEMVER:introduced=0,fixed=11.2.0.

Is there a fix for CVE-2026-57439?

Yes. cyberchef (npm): upgrade to 11.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57439 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-57439?

Check whether you run GCHQ CyberChef or cyberchef (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57439: GCHQ CyberChef prototype pollution in Series Chart operation

Q: Which products and versions are affected?

GCHQ CyberChef < 11.2.0; cyberchef (npm) SEMVER:introduced=0,fixed=11.2.0.

Q: Is there a fix for CVE-2026-57439?

Yes. cyberchef (npm): upgrade to 11.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57439 attacked?

It is attacked with local access, in a web application.

Q: Am I affected by CVE-2026-57439?

Check whether you run GCHQ CyberChef or cyberchef (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57439 · Severity: medium · CVSS 5 · Published 2026-07-08

CyberChef, a popular web-based tool for data analysis and encryption, contains a vulnerability in its 'Series Chart' feature. An attacker can provide a specially crafted CSV file that, when processed, allows them to execute malicious code within the user's browser. This could lead to the theft of sensitive data being processed in the tool or unauthorized actions performed on behalf of the user.

Technologies: GCHQ CyberChef. Vendors: GCHQ, npm.

Quick answers

Is CVE-2026-57439 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57439 being exploited in the wild.
How severe is CVE-2026-57439?: Medium severity, with a CVSS score of 5, published 8 July 2026.
Which products and versions are affected?: GCHQ CyberChef < 11.2.0; cyberchef (npm) SEMVER:introduced=0,fixed=11.2.0.
Is there a fix for CVE-2026-57439?: Yes. cyberchef (npm): upgrade to 11.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57439 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-57439?: Check whether you run GCHQ CyberChef or cyberchef (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

cyberchef (npm): upgrade to 11.2.0 or later
```
npm install cyberchef@11.2.0
```

Technical details

A prototype pollution vulnerability exists in CyberChef's 'Series Chart' operation prior to version 11.2.0. The root cause is the operation's CSV parser accepting the '__proto__' key, which allows an attacker to modify the properties of the base JavaScript Object prototype. This can be chained with other operations, such as 'Parse UDP', which uses the 'objToTable' function in 'src/core/lib/Protocol.mjs' to render data in HTML tables without proper escaping. By polluting the prototype, an attacker can inject malicious JavaScript into the HTML output, resulting in Cross-Site Scripting (XSS). Exploitation requires a user to load a malicious recipe or input data. The issue is fixed in version 11.2.0 by using 'Object.create(null)' for data structures.

Affected products

GCHQ CyberChef < 11.2.0

Identifiers

CVE-2026-57439
GHSA-fx6f-382r-j72c

Timeline

2026-06-05: disclosed: Vulnerability reported by researcher @hyuunnn
2026-06-17: patched: Fix merged and version 11.2.0 released
2026-07-08: advisory: NVD and GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.