CVE-2026-42615 CyberChef has a Cross-site Scripting issue
An attacker can execute arbitrary scripts in the victim's browser via the Show Base64 offsets feature in CyberChef.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42615?
CVE-2026-42615 is a high-severity cross-site scripting vulnerability in GCHQ CyberChef, published on 29 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.
Weakness: CWE-79
Which versions are affected by CVE-2026-42615?
2 open source packages ship an affected version, including cyberchef.
| Package | Affected | Fixed in |
|---|---|---|
cyberchef npm | All versions | 11.0.0 |
cyberchef npm | All versions | 11.0.0 |
How do I fix CVE-2026-42615?
Upgrade cyberchef to 11.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-42615 being exploited?
There is no known exploitation of CVE-2026-42615 in the wild and no public exploit code.
Sources
Also known as GHSA-h4hv-92pp-pcjg.