CyberChef’s Series Chart operation accepts the string __proto__ as a key when parsing CSV input, which can pollute JavaScript’s prototype chain. When combined with the Parse UDP operation, crafted input can inject malicious JavaScript into the generated HTML output, enabling an attacker to execute arbitrary code in a victim’s browser. This results in a client‑side cross‑site scripting vector rooted in prototype pollution.

All releases of the GCHQ CyberChef web application prior to version 11.2.0 are vulnerable. The issue was addressed in CyberChef v11.2.0.

The CVSS score is 5.0, and the EPSS score is <1 % (approximately 0.00094), indicating a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors require an attacker to supply crafted CSV data to the Series Chart operation, optionally chaining it with Parse UDP, and depend on an end‑user browsing the resulting HTML. Because the flaw is client‑side, it does not lead to remote code execution on the server but provides a cross‑site scripting risk.