Description
GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets(‘%3Cscript substring.
Recommendation
Update the cyberchef package to the latest compatible version. Followings are version details:
- Affected version(s): < 11.0.0
- Patched version(s): 11.0.0
References
Related Issues
- LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution - CVE-2026-42045
- Slim Select has potential Cross-site Scripting issue - CVE-2024-9440
- DbGate has cross site scripting via the SVG Icon String Handler component - CVE-2026-6216
- beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS) - CVE-2026-26226
You might also like:
- Tags:
- npm
- cyberchef
Anything's wrong? Let us know Last updated on May 06, 2026