CVE-2026-42615: CyberChef has a Cross-site Scripting issue

April 29, 2026 (updated May 6, 2026)

GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets(’%3Cscript substring.

References

github.com/advisories/GHSA-h4hv-92pp-pcjg
github.com/gchq/CyberChef/commit/9641ae07f92e9af50f10e978385465b2f4a36c4d
github.com/gchq/CyberChef/compare/v10.24.0...v11.0.0
github.com/gchq/CyberChef/issues/2344
github.com/gchq/CyberChef/pull/2346
nvd.nist.gov/vuln/detail/CVE-2026-42615

Code Behaviors & Features

Detect and mitigate CVE-2026-42615 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →