# CyberChef v10.23.0

- Product: CyberChef (https://whatsnew.fyi/product/cyberchef)
- Vendor: gchq
- Date: 2026-04-07
- Version: v10.23.0
- Original notes: https://github.com/gchq/CyberChef/releases/tag/v10.23.0
- Permalink: https://whatsnew.fyi/product/cyberchef/releases/v10.23.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Properly escape HTML entities in sampleDelim to avoid XSS issue
- **fixed** — ParseEthernetFrame - Fix vlan calculation
- **fixed** — Return empty output for zero-length To Modhex input
- **added** — Add tab focus to top banner and navigation to About/Support Modal
- **added** — Add Parse Ethernet frame Operation, allow Parse IPv4 Header to cascade
- **added** — Selection and Deselection of autobake checkbox using keyboard
- **added** — Add more helpful error for when numerical ingredient is left empty
- **added** — Add Raw option for Jq operation
- **added** — Add Extract Audio Metadata operation
- **fixed** — Fix Jq issue
- **fixed** — Return empty string instead of empty array for empty input in A1Z26
- **added** — Add ARM disassembler operation
- **added** — Add Text/Integer Converter operation
- **added** — Add RC6 Encrypt/Decrypt operations
- **fixed** — Add Bootstrap form style for CodeMirror editor
- **added** — Add Flask Session operations (Decode, Sign, Verify)
- **changed** — Update jq-web to jq-wasm with jq version 1.8.1
- **added** — Add random integer generation operation
- **added** — Add BigInt utility functions for number theory operations
- **changed** — Improve SQL Beautify: use sql-formatter and support bind variables

- Properly escape HTML entities in sampleDelim to avoid XSS issue [@GCHQDeveloper581] | [#2307]
- chore (deps): bump lodash from 4.17.23 to 4.18.1  | [#2304]
- chore (deps): bump @codemirror/view from 6.40.0 to 6.41.0  | [#2305]
- chore (deps): bump the patch-updates group with 2 updates  | [#2303]
- chore (deps): bump @xmldom/xmldom from 0.8.11 to 0.8.12  | [#2302]
- chore (deps): bump picomatch  | [#2299]
- chore (deps): bump node-forge from 1.3.3 to 1.4.0  | [#2297]
- chore (deps): bump the patch-updates group with 3 updates | [#2296]
- chore (deps) bump chromedriver from 130.0.4 to 146.0.6 [@GCHQDeveloper581] | [#2292]
- ParseEthernetFrame - Fix vlan calculation [@Kalkran] | [#2295]
- Add pull request template with AI usage disclosure [@C85297] | [#2279]
- fix: return empty output for zero-length To Modhex input [@saschabuehrle] | [#2249]
- Added tab focus to top banner and navigation to About/Support Modal [@j264415] | [#1733]
- Add Parse Ethernet frame Operation, allow Parse IPv4 Header to cascade [@Kalkran] | [#1722]
- Selection and Deselection of autobake checkbox using keyboard [@j264415] | [#1727]
- chore (deps): bump @babel/runtime from 7.28.6 to 7.29.2  | [#2263]
- Add more helpful error for when numerical ingredient is left empty [@Lamby777] [@C85297] | [#1540]
- chore (deps): bump @codemirror/view from 6.39.17 to 6.40.0  | [#2262]
- Bump flatted from 3.3.2 to 3.4.2 [@GCHQDeveloper581] | [#2266]
- feat: add Raw option for Jq operation [@rtpt-romankarwacik] | [#2237]
- chore (deps): bump core-js from 3.48.0 to 3.49.0  | [#2261]
- chore (deps): bump the patch-updates group with 6 updates  | [#2260]
- Add Extract Audio Metadata operation [@d0s1nt] [@GCHQDeveloper581] | [#2170]
- Fix Jq issue [@GCHQDeveloper581] | [#2210]
- Configure dependabot updates [@GCHQDeveloper581] | [#2259]
- fix(A1Z26): return empty string instead of empty array for empty input [@brick-pixel] | [#2257]
- Fix broken Docker link in README [@am-periphery] | [#2250]
- Update some dependencies, including a number causing npm audit warnings [@GCHQDeveloper581] | [#2236]
- Bump axios from 1.7.9 to 1.13.6  | [#2234]
- Bump jws from 3.2.2 to 3.2.3  | [#2235]
- Bump pbkdf2 from 3.1.2 to 3.1.5  | [#2229]
- Bump form-data from 4.0.1 to 4.0.5  | [#2228]
- Bump basic-ftp from 5.0.5 to 5.2.0  | [#2231]
- feat: add ARM disassembler operation [@thomasxm] | [#2156]
- Add Text/Integer Converter operation [@p-leriche] [@GCHQDeveloper581] | [#2213]
- Feat/rc6 add RC6 Encrypt/Decrypt operations [@thomasxm] | [#2163]
- [bugfix] Add Bootstrap form style for CodeMirror editor [@Swonkie] | [#2161]
- Add Flask Session operations (Decode, Sign, Verify) [@ThePlayer372-FR] | [#2208]
- fix: `jq-web` -> `jq-wasm`, includes `jq` version `1.8.1` [@W-Floyd] [@GCHQDeveloper581] | [#2223]
- Bump jsonwebtoken from 8.5.1 to 9.0.0 [@GCHQDeveloper581] | [#2219]
- Bump basic-ftp from 5.0.5 to 5.2.0  | [#2218]
- feat: add random integer generation operation [@cktgh] | [#2151]
- Add BigInt utility functions for number theory operations [@p-leriche] [@GCHQDeveloper581] | [#2205]
- Improve SQL Beautify: use sql-formatter and support bind variables [@aby-jo] [@GCHQDeveloper581] | [#2071]
- update tesseract.js to 6.0.1 [@atsiv1] | [#2133]
- Fix hint tooltip display issues [@bartvanandel] | [#2017]
- Simplify babel dependencies [@GCHQDeveloper581] | [#2204]
- Dependency updates [@GCHQDeveloper581] | [#2201]
- Fix: Move Magic checks from Escape to Unescape Unicode Characters [@fjh1997] | [#2195]
- Paste spreadsheets as text [@C85297] | [#2200]
- Fix Roboto Mono font [@C85297] | [#2199]
- Fix return of buffer for PNG QR image generation [@GCHQDeveloper581] [@C85297] | [#2125]
- Update JIMP [@C85297] | [#2171]
- Overwrite NGINX maintainer label [@C85297] | [#2194]
- Bump v10.22.1 [@GCHQDeveloper581] | [#2193]
- Fix npm publish - Run "npm ci" and "npm run node" under node 18 then switch to node 24.5 [@GCHQDeveloper581] | [#2192]