The vulnerability is a reflected cross‑site scripting flaw triggered when a maliciously crafted recipe string is processed by CyberChef’s Show Base64 offsets function. An injected <script> element can be executed in the context of the victim’s browser, permitting the attacker to steal session cookies, deface the interface, or execute further malicious actions. The weakness is identified as CWE‑79, a classic example of improper handling of user‑supplied data.

GCHQ CyberChef versions prior to 11.0.0, including the 10.x series (e.g., 10.24.0), are affected. The vulnerability manifests when the Show Base64 offsets recipe is invoked via a crafted URL such as /#recipe=Show_Base64_offsets('%3Cscript…).

The CVSS score of 7.2 reflects a high risk with medium to high potential impact for users who load untrusted recipe URLs. The EPSS score is not available, but the vulnerability is not currently listed in CISA's KEV catalog, indicating it has no known large‑scale exploitation campaigns reported. Attackers can feasibly abuse the flaw by embedding malicious recipe links into phishing messages or compromised websites, relying on user interaction to trigger the script. If successful, the attack grants the attacker the same privileges as the end user within the affected browser session.