CVE-2020-13756

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 98.95%
Affected Products (NVD)
VendorProductVersion
sabberwormphp_css_parser
𝑥
< 8.3.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php-horde-css-parser
bookworm
ignored
bullseye
vulnerable
bullseye (security)
1.0.11-8+deb11u1
fixed
sid
1.0.11-8.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php-horde-css-parser
bionic
Fixed 1.0.11-1ubuntu1+esm1
released
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
xenial
Fixed 1.0.8-1ubuntu1+esm1
released
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.html
http://seclists.org/fulldisclosure/2020/Jun/7
https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4
https://github.com/sabberworm/PHP-CSS-Parser/releases/tag/8.3.1
http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.html
http://seclists.org/fulldisclosure/2020/Jun/7
https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4
https://github.com/sabberworm/PHP-CSS-Parser/releases/tag/8.3.1
https://lists.debian.org/debian-lts-announce/2025/10/msg00013.html