CVE-2020-13756
Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
- Record
CVE-2020-13756- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
- Record
CVE-2020-13756- Updated
- 2026-11-02
EUVDEUVD-2022-1499 No score
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
- Record
EUVD-2022-1499- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-phrq-v4q2-hmq6
Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
- Record
GHSA-phrq-v4q2-hmq6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
OSV
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
- Record
CVE-2020-13756- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-13756
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
- Record
DEBIAN-CVE-2020-13756- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-phrq-v4q2-hmq6
Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
- Record
GHSA-phrq-v4q2-hmq6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-13756
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
- Record
UBUNTU-CVE-2020-13756- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-7502-1 No score
php-horde-css-parser vulnerability
It was discovered that Horde Css Parser did not correctly handle parsing uncontrolled CSS data. An attacker could possibly use this issue to perform remote code execution. (CVE-2020-13756)
- Record
USN-7502-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sabberworm/php-css-parserPackagist |
8.3.0 up to 8.3.1 | 8.3.1 |
sabberworm/php-css-parserPackagist |
8.2.0 up to 8.2.1 | 8.2.1 |
sabberworm/php-css-parserPackagist |
8.1.0 up to 8.1.1 | 8.1.1 |
sabberworm/php-css-parserPackagist |
8.0.0 up to 8.0.1 | 8.0.1 |
sabberworm/php-css-parserPackagist |
7.0.0 up to 7.0.4 | 7.0.4 |
sabberworm/php-css-parserPackagist |
6.0.0 up to 6.0.2 | 6.0.2 |
sabberworm/php-css-parserPackagist |
5.2.0 up to 5.2.1 | 5.2.1 |
sabberworm/php-css-parserPackagist |
5.1.0 up to 5.1.3 | 5.1.3 |
sabberworm/php-css-parserPackagist |
5.0.0 up to 5.0.9 | 5.0.9 |
sabberworm/php-css-parserPackagist |
4.0.0 up to 4.0.1 | 4.0.1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sabberworm/php-css-parserPackagist |
3.0.0 up to 3.0.1 | 3.0.1 |
sabberworm/php-css-parserPackagist |
2.0.0 up to 2.0.1 | 2.0.1 |
sabberworm/php-css-parserPackagist |
1.0.0 up to 1.0.1 | 1.0.1 |
php-horde-css-parserDebian:12 |
All versions, plus listed versions 1.0.11-81.0.11-8.1 |
None known |
php-horde-css-parserDebian:11 |
before 1.0.11-8+deb11u1, plus listed versions 1.0.11-8 |
1.0.11-8+deb11u1 |
sabberworm/php-css-parserPackagist |
7.0.0 up to 7.0.4, plus listed versions 7.0.17.0.27.0.3 |
7.0.4 |
sabberworm/php-css-parserPackagist |
6.0.0 up to 6.0.2, plus listed versions 6.0.1 |
6.0.2 |
sabberworm/php-css-parserPackagist |
5.1.0 up to 5.1.3, plus listed versions 5.1.15.1.2 |
5.1.3 |
sabberworm/php-css-parserPackagist |
5.0.0 up to 5.0.9, plus listed versions 5.0.15.0.25.0.35.0.45.0.55.0.65.0.75.0.8 |
5.0.9 |
php-horde-css-parserUbuntu:Pro:16.04:LTS |
before 1.0.8-1ubuntu1+esm1, plus listed versions 1.0.7-11.0.7-21.0.8-11.0.8-1ubuntu1 |
1.0.8-1ubuntu1+esm1 |
php-horde-css-parserUbuntu:Pro:18.04:LTS |
before 1.0.11-1ubuntu1+esm1, plus listed versions 1.0.11-11.0.11-1ubuntu1 |
1.0.11-1ubuntu1+esm1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | KrE80r/CVE-2020-13756-env | 2025-12-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-13756 is a critical vulnerability (CVSS 9.8) in Sabberworm Php Css Parser, published June 3, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 49.8%, the 98th percentile. Fixed in sabberworm/php-css-parser 8.3.1.
References
github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4
seclists.org/fulldisclosure/2020/Jun/7
packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.html
lists.debian.org/debian-lts-announce/2025/10/msg00013.html
nvd.nist.gov/vuln/detail/CVE-2020-13756
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2020-13756
ubuntu.com/security/CVE-2020-13756
cve.org/CVERecord?id=CVE-2020-13756