CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #…
Medium CVSS 4.3
Summary
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during sta…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/gchq/CyberChef/commit/f77ddf489050b339faa978bb28da954bafd289ae
- https://github.com/gchq/CyberChef/pull/2687
- https://github.com/gchq/CyberChef/releases/tag/v11.3.0
- https://github.com/gchq/CyberChef/security/advisories/GHSA-w74r-jxjh-gwr6
Timeline
- nvd_ingest NVD