CyberChef uses a pretty‑recipe parser in Utils.mjs that synchronously applies a complex global regular expression to parse #recipe= URL fragments. When faced with a malformed fragment that contains a large number of unmatched quote characters, the parser performs heavy backtracking, exhausting the client‑side CPU and freezing the browser tab for seconds or longer. No code execution or data exfiltration occurs; the exploitation results in a denial‑of‑service to the user’s browser.

The issue affects CyberChef from any version earlier than 11.3.0, distributed by GCHQ. Users running outdated CyberChef deployments are susceptible.

The CVSS score of 4.3 indicates a moderate impact. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local client‑side: a malicious #recipe= URL is opened in a user’s browser. Because the exploit causes only CPU exhaustion and does not lead to code execution or privilege escalation, the risk is primarily to user availability. Adversaries could target users via phishing or compromised websites that embed such URLs, but the likelihood of widespread exploitation is limited by the lack of a more severe vector.