GHSA-jp6r-xcjj-5h7rMediumCVSS 6.1

Cross-Site Scripting in cyberchef

Published
August 27, 2019
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2019-15532 →

📋 Description

Versions of cyberchef prior to 8.31.3 are vulnerable to Cross-Site Scripting. In Text Encoding Brute Force the table rows are created by concatenating the value variable unsanitized in the HTML code. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 8.31.3 or later.

🎯 Affected products1

  • npm/cyberchef:< 8.31.3

🔗 References (8)