{"id":"CVE-2020-13756","aliases":["DEBIAN-CVE-2020-13756","DLA-4333-1","EUVD-2022-1499","GHSA-phrq-v4q2-hmq6","UBUNTU-CVE-2020-13756","USN-7502-1"],"status":"published","title":"Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()","description":"Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.49797,"percentile":0.98906,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-94"],"published":"2020-06-03T13:46:56Z","modified":"2026-10-26T12:00:33Z","exploits":[{"source":"pocgithub","id":"KrE80r/CVE-2020-13756-env","title":"KrE80r/CVE-2020-13756-env","date":"2025-12-06","url":"https://github.com/KrE80r/CVE-2020-13756-env"}],"fixes":[{"ecosystem":"Packagist","package":"sabberworm/php-css-parser","fixed_in":["8.3.1","8.2.1","8.1.1","8.0.1","7.0.4","6.0.2","5.2.1","5.1.3","5.0.9","4.0.1","3.0.1","2.0.1","1.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:11","package":"php-horde-css-parser","fixed_in":["1.0.11-8+deb11u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php-horde-css-parser","fixed_in":["1.0.8-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"php-horde-css-parser","fixed_in":["1.0.11-1ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.0"},{"fixed":"8.3.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.0"},{"fixed":"8.2.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0"},{"fixed":"8.1.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.9"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"php-horde-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.11-8","1.0.11-8.1"]},{"source":"osv","ecosystem":"Debian:11","package":"php-horde-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11-8+deb11u1"}]}],"versions":["1.0.11-8"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.0"},{"fixed":"8.3.1"}]}],"versions":["8.3.0"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.0"},{"fixed":"8.2.1"}]}],"versions":["8.2.0"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0"},{"fixed":"8.1.1"}]}],"versions":["8.1.0"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.1"}]}],"versions":["8.0.0"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.4"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.3"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.2"}]}],"versions":["6.0.0","6.0.1"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.1"}]}],"versions":["5.2.0"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.3"}]}],"versions":["5.1.0","5.1.1","5.1.2"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.9"}]}],"versions":["5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.1"}]}],"versions":["3.0.0"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"Packagist","package":"sabberworm/php-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php-horde-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1ubuntu1+esm1"}]}],"versions":["1.0.7-1","1.0.7-2","1.0.8-1","1.0.8-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"php-horde-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11-1ubuntu1+esm1"}]}],"versions":["1.0.11-1","1.0.11-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"php-horde-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-1ubuntu1+esm1"}]}],"versions":["1.0.7-1","1.0.7-2","1.0.8-1","1.0.8-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"php-horde-css-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.11-1ubuntu1+esm1"}]}],"versions":["1.0.11-1","1.0.11-1ubuntu1"]}],"products":[{"vendor":"sabberworm","product":"php_css_parser"}],"references":[{"url":"https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/sabberworm/PHP-CSS-Parser/releases/tag/8.3.1","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2020/Jun/7","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence","web"]},{"url":"http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00013.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13756","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/sabberworm/php-css-parser/CVE-2020-13756.yaml","tags":["web"]},{"url":"https://packetstormsecurity.com/files/cve/CVE-2020-13756","tags":["web"]},{"url":"https://github.com/advisories/GHSA-phrq-v4q2-hmq6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13756","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-13756","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13756","tags":["report"]},{"url":"https://github.com/MyIntervals/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7502-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-13756","description":"Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.","status":"published","published":"2020-06-03T13:46:56Z","modified":"2025-11-03T17:30:46.974Z","updated_at":"2026-11-02T14:35:53.868619Z"}],"euvd":[{"id":"EUVD-2022-1499","description":"Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.","status":"published","published":"2020-06-03T13:46:56Z","modified":"2025-11-03T17:30:46Z","updated_at":"2026-11-02T19:49:35.000596Z"}],"ghsa":[{"id":"GHSA-phrq-v4q2-hmq6","title":"Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()","description":"Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.","status":"published","published":"2022-03-26T00:15:22Z","modified":"2025-11-03T21:51:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-94"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2020-13756","description":"Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.","status":"published","published":"2020-06-03T14:15:12.703Z","modified":"2026-06-17T02:53:36.113Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:06:04.922138Z"}],"osv":[{"id":"CVE-2020-13756","description":"Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.","status":"published","published":"2020-06-03T14:15:12.703Z","modified":"2026-10-20T10:51:48.50714072Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-13756","description":"Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.","status":"published","published":"2020-06-03T14:15:12.703Z","modified":"2026-10-26T12:00:33.712939655Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-phrq-v4q2-hmq6","title":"Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()","description":"Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.","status":"published","published":"2022-03-26T00:15:22Z","modified":"2025-11-03T22:10:19.619337Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-94"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"UBUNTU-CVE-2020-13756","description":"Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.","status":"published","published":"2020-06-03T14:15:00Z","modified":"2026-02-04T03:06:25.541764Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"DLA-4333-1","title":"php-horde-css-parser - security update","status":"published","published":"2025-10-14T00:00:00Z","modified":"2025-10-14T17:32:07.727507Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"USN-7502-1","title":"php-horde-css-parser vulnerability","description":"It was discovered that Horde Css Parser did not correctly handle\nparsing uncontrolled CSS data. An attacker could possibly use\nthis issue to perform remote code execution. (CVE-2020-13756)\n","status":"published","published":"2025-05-07T15:51:11Z","modified":"2026-06-25T13:32:30.387215431Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}