Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()
Critical severity
GitHub Reviewed
Published
Mar 26, 2022
to the GitHub Advisory Database
•
Updated Sep 21, 2023
Package
Affected versions
>= 8.3.0, < 8.3.1
>= 8.2.0, < 8.2.1
>= 8.1.0, < 8.1.1
>= 8.0.0, < 8.0.1
>= 7.0.0, < 7.0.4
>= 6.0.0, < 6.0.2
>= 5.2.0, < 5.2.1
>= 5.1.0, < 5.1.3
>= 5.0.0, < 5.0.9
>= 4.0.0, < 4.0.1
>= 3.0.0, < 3.0.1
>= 2.0.0, < 2.0.1
>= 1.0.0, < 1.0.1
Patched versions
8.3.1
8.2.1
8.1.1
8.0.1
7.0.4
6.0.2
5.2.1
5.1.3
5.0.9
4.0.1
3.0.1
2.0.1
1.0.1
Description
Published to the GitHub Advisory Database
Mar 26, 2022
Reviewed
Mar 26, 2022
Last updated
Sep 21, 2023
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
References