Description
GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets(‘%3Cscript substring.
Recommendation
Update the cyberchef package to the latest compatible version. Followings are version details:
- Affected version(s): < 11.0.0
- Patched version(s): 11.0.0
References
Related Issues
- Angular's deprecated package has a Cross-Site Scripting issue - CVE-2026-11998
- LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution - CVE-2026-42045
- CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - @ckeditor/ckeditor5-html-support - CVE-2026-28343
- CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - CVE-2026-28343
You might also like:
- Tags:
- npm
- cyberchef
Anything's wrong? Let us know Last updated on May 06, 2026