high7.2
CVE-2026-42615
GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.
Impact
GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | cyberchef | < 11.0.0 | 11.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-h4hv-92pp-pcjg
- https://nvd.nist.gov/vuln/detail/CVE-2026-42615
- https://github.com/gchq/CyberChef/issues/2344
- https://github.com/gchq/CyberChef/pull/2346
- https://github.com/gchq/CyberChef/commit/9641ae07f92e9af50f10e978385465b2f4a36c4d
- https://github.com/gchq/CyberChef/compare/v10.24.0...v11.0.0