Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1waHJxLXY0cTItaG1xNs02Ag

Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.

Permalink: https://github.com/advisories/GHSA-phrq-v4q2-hmq6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1waHJxLXY0cTItaG1xNs02Ag
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: 10 months ago


CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-phrq-v4q2-hmq6, CVE-2020-13756
References: Repository: https://github.com/sabberworm/PHP-CSS-Parser
Blast Radius: 42.3

Affected Packages

packagist:sabberworm/php-css-parser
Dependent packages: 57
Dependent repositories: 20,778
Downloads: 109,102,426 total
Affected Version Ranges: >= 1.0.0, < 1.0.1, >= 2.0.0, < 2.0.1, >= 3.0.0, < 3.0.1, >= 4.0.0, < 4.0.1, >= 5.0.0, < 5.0.9, >= 5.1.0, < 5.1.3, >= 5.2.0, < 5.2.1, >= 6.0.0, < 6.0.2, >= 7.0.0, < 7.0.4, >= 8.0.0, < 8.0.1, >= 8.1.0, < 8.1.1, >= 8.2.0, < 8.2.1, >= 8.3.0, < 8.3.1
Fixed in: 1.0.1, 2.0.1, 3.0.1, 4.0.1, 5.0.9, 5.1.3, 5.2.1, 6.0.2, 7.0.4, 8.0.1, 8.1.1, 8.2.1, 8.3.1
All affected versions: 1.0.0, 2.0.0, 3.0.0, 4.0.0, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.1.0, 5.1.1, 5.1.2, 5.2.0, 6.0.0, 6.0.1, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 8.0.0, 8.1.0, 8.2.0, 8.3.0
All unaffected versions: 1.0.1, 2.0.1, 3.0.1, 4.0.1, 5.0.9, 5.1.3, 5.2.1, 6.0.2, 7.0.4, 8.0.1, 8.1.1, 8.2.1, 8.3.1, 8.4.0, 8.5.0, 8.5.1, 8.5.2, 8.6.0