What’s Vulnerable › Vulnerabilities

CVE-2020-6836

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-11 · updated 2026-06-17
• Weakness: CWE-94

Description

grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may allow attackers to run arbitrary commands on the server.

Affected products

• Hot-Formula-Parser Project Hot-Formula-Parser: before 3.0.1 — fixed in 3.0.1

How to fix

Upgrade to a fixed version: Hot-Formula-Parser Project Hot-Formula-Parser 3.0.1. Check the vendor advisory for mitigations.

References

• https://blog.truesec.com/2020/01/17/reverse-shell-through-a-node-js-math-parser/
• https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e
• https://www.npmjs.com/advisories/1439
• https://blog.truesec.com/2020/01/17/reverse-shell-through-a-node-js-math-parser/
• https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e
• https://www.npmjs.com/advisories/1439

Get alerted when CVE-2020-6836 or the next vulnerability affects your stack