[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZP2I4xxOxt5Uvyh9vSegD10nZFu7raRQdPaLeNmrSfM":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"36e15df2-a55a-4716-a0a3-f191f5fbb60d","Researchers Chain Cloudflare Security Flaws to Bypass CSP and Execute Malicious JavaScript","researchers-chain-cloudflare-security-flaws-to-bypass-csp-and-execute-malicious-393ae7","Security researchers at Searchlight Cyber chained several small weaknesses in Cloudflare’s image feature. The chain let them run JavaScript on a site that was meant to block it. Kevin Gervot and Adam Kues published the work on October 28, 2026, in a write-up titled Cache Me If You Can. They showed a working cross-site scripting […] The post Researchers Chain Cloudflare Security Flaws to Bypass CSP and Execute Malicious JavaScript appeared first on Cyber Security News.","Security researchers discovered a chain of vulnerabilities in Cloudflare's image feature that allowed them to bypass Content Security Policy (CSP) and execute malicious JavaScript. The exploit leverages weaknesses in how Cloudflare processes SVG images and handles cache control headers, enabling cross-site scripting (XSS) attacks.","Researchers chained Cloudflare security flaws to bypass CSP and execute malicious JavaScript.","https:\u002F\u002Fcybersecuritynews.com\u002Fcloudflare-xss-vulnerability\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FCloudflare-security-flaws.webp","2026-10-28T15:38:06+00:00","2026-10-28T16:00:10.870731+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Cloudflare","vendor",{"name":21,"type":22},"svg-hush","product",{"name":24,"type":25},"Content Security Policy","technology",{"name":27,"type":25},"cross-site scripting",{"name":29,"type":19},"Searchlight Cyber","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,29,21],{"controls":51,"vendors":134},[52,81,106],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":82,"name":83,"problem":84,"products":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",[86,94,98],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":82,"product_name":95,"url":96,"description":97},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":107,"name":108,"problem":109,"products":110},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",{"vendor_slug":128,"vendor_name":18,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",[135],{"slug":128,"name":18,"logo_path":129,"roles":136},[137],"affected",{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"chained-cloudflare-flaws-enable-csp-bypass-and-xss-attacks","Chained Cloudflare Flaws Enable CSP Bypass and XSS Attacks","Researchers discovered that weaknesses in Cloudflare's SVG image processing and cache control header handling could be chained together to bypass Content Security Policy (CSP) protections — one of the web's primary defenses against cross-site scripting (XSS). This matters because CSP is widely trusted as a critical last line of defense, and demonstrating its bypass via a trusted third-party CDN provider undermines the security assumptions of countless websites relying on Cloudflare. The vulnerability highlights that even security-adjacent infrastructure can introduce exploitable flaws when input handling and HTTP header controls are improperly implemented. Organizations that assumed CSP alone was sufficient without validating the behavior of third-party services integrated into their stack were particularly exposed.",[143,144,145,146,147,148,149],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":151,"PCI DSS Requirement 6":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"OWASP A06:2021 Vulnerable and Outdated Components":154,"CIS Control 7: Continuous Vulnerability Management":155,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":156,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":157},"NIS2 requires entities to implement measures for handling incidents and vulnerabilities in supply chain and third-party service dependencies, directly applicable to organizations that relied on Cloudflare without independently verifying its security configuration.","Requirement 6 mandates that organizations develop and maintain secure systems and software, including evaluating and patching vulnerabilities in third-party components that handle web content — such as a CDN processing user-facing SVG images.","SI-2 requires organizations to identify, report, and correct information system flaws — including those introduced by integrated third-party services — which directly applies to tracking and patching Cloudflare's image-processing vulnerabilities.","Relying on a misconfigured or unpatched third-party CDN component (Cloudflare's image feature) without validating its security posture is a direct instance of the risks described under vulnerable and outdated components.","Regular scanning and timely remediation of vulnerabilities in third-party services like Cloudflare would have surfaced these SVG and cache-header flaws before attackers could chain them into a working exploit.","This control mandates timely identification and remediation of technical vulnerabilities in systems and services in use, which would have required monitoring Cloudflare's security advisories and acting on the disclosed CSP bypass weaknesses.","Although CSP is a browser-enforced control, ensuring that trust boundaries for third-party resources are explicitly defined and validated aligns with the principle of governing what is authorized to execute in a given context."]