What’s Vulnerable › Vulnerabilities

CVE-2020-13756: Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 49.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-06-03 · updated 2026-06-17
• Weakness: CWE-94

Description

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.

Affected products

• Sabberworm Php Css Parser: before 8.3.1 — fixed in 8.3.1
• Packagist Sabberworm/Php-Css-Parser: from 8.3.0 before 8.3.1; from 8.2.0 before 8.2.1; from 8.1.0 before 8.1.1; from 8.0.0 before 8.0.1; from 7.0.0 before 7.0.4; from 6.0.0 before 6.0.2 — fixed in 8.3.1, 8.2.1, 8.1.1, 8.0.1, 7.0.4, 6.0.2

How to fix

Upgrade to a fixed version: Sabberworm Php Css Parser 8.3.1; Packagist Sabberworm/Php-Css-Parser 8.3.1, 8.2.1, 8.1.1, 8.0.1. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.html
• http://seclists.org/fulldisclosure/2020/Jun/7
• https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4
• https://github.com/sabberworm/PHP-CSS-Parser/releases/tag/8.3.1
• http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.html
• http://seclists.org/fulldisclosure/2020/Jun/7
• https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4
• https://github.com/sabberworm/PHP-CSS-Parser/releases/tag/8.3.1
• https://lists.debian.org/debian-lts-announce/2025/10/msg00013.html

Get alerted when CVE-2020-13756 or the next vulnerability affects your stack