CVE-2026-42615: Gchq Cyberchef

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.

Affected products

• Gchq Cyberchef: before 11.0.0 (fixed in 11.0.0)

Published 2026-04-29. Last modified 2026-07-24.