CVEvulnerability
CVE-2020-13756
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-06-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
Affected configurations
• sabberworm php css parser (< 8.3.1)
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Jun/7 Exploit, Mailing List, Third Party Advisory
- https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4 Patch, Third Party Advisory
- https://github.com/sabberworm/PHP-CSS-Parser/releases/tag/8.3.1 Release Notes, Third Party Advisory
- http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Jun/7 Exploit, Mailing List, Third Party Advisory
- https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4 Patch, Third Party Advisory
- https://github.com/sabberworm/PHP-CSS-Parser/releases/tag/8.3.1 Release Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00013.html lists.debian.org