CVE-2026-72912

{
  "id": "CVE-2026-72912",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-10T21:17:26.130",
  "lastModified": "2026-10-23T19:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0."
    },
    {
      "lang": "es",
      "value": "CyberChef es una aplicación web para cifrado, codificación, compresión y análisis de datos. Antes de la versión 11.3.0, el analizador pretty-recipe de CyberChef en src/core/Utils.mjs puede agotar la CPU del lado del cliente cuando un fragmento de URL #recipe= malformado que contiene un gran número de caracteres de comillas no coincidentes llega a Utils.parseRecipeConfig(). La función aplica sincrónicamente una expresión regular global compleja que puede realizar un retroceso intensivo antes de rechazar la entrada, lo que provoca que la pestaña del navegador de la víctima se congele durante el inicio durante segundos o más. No se produce ejecución de código, exfiltración de datos o escalada de privilegios. Este problema está solucionado en la versión 11.3.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "gchq",
          "product": "CyberChef",
          "versions": [
            {
              "version": "< 11.3.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T22:08:01.746436Z",
          "id": "CVE-2026-72912",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/gchq/CyberChef/commit/f77ddf489050b339faa978bb28da954bafd289ae",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gchq/CyberChef/pull/2687",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gchq/CyberChef/releases/tag/v11.3.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-w74r-jxjh-gwr6",
      "source": "[email protected]"
    }
  ]
}