CVE-2026-57439
MEDIUM
NVD
CVSS Score
5
Severity
MEDIUM
Published
Jul 08, 2026
Vendor
unknown
Description
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0.