Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2020-13756 EUVD-2022-1499GHSA-phrq-v4q2-hmq6

Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()

Published Jun 3, 2020 · Updated Nov 3, 2025 · Assigned by mitre

Package: php-horde-css-parser Package: php-horde-css-parser Package: sabberworm/php-css-parser Ecosystem: Debian Ecosystem: Packagist Ecosystem: Ubuntu

Description

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 php-horde-css-parser No fix yet —
Debian 11 php-horde-css-parser 1.0.11-8+deb11u1 DLA-4333-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS php-horde-css-parser 1.0.11-1ubuntu1+esm1 USN-7502-1
Ubuntu Pro 16.04 LTS php-horde-css-parser 1.0.8-1ubuntu1+esm1 USN-7502-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • KrE80r/CVE-2020-13756-env ★ 0 · Dec 6, 2025

    Vulnerable test environment for CVE-2020-13756 (Sabberworm PHP CSS Parser RCE)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist sabberworm/php-css-parser >= 8.3.0, < 8.3.1 8.3.1 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 8.2.0, < 8.2.1 8.2.1 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 8.1.0, < 8.1.1 8.1.1 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 8.0.0, < 8.0.1 8.0.1 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 7.0.0, < 7.0.4 7.0.4 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 6.0.0, < 6.0.2 6.0.2 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 5.2.0, < 5.2.1 5.2.1 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 5.1.0, < 5.1.3 5.1.3 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 5.0.0, < 5.0.9 5.0.9 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 4.0.0, < 4.0.1 4.0.1 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 3.0.0, < 3.0.1 3.0.1 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 2.0.0, < 2.0.1 2.0.1 GHSA-phrq-v4q2-hmq6
Packagist sabberworm/php-css-parser >= 1.0.0, < 1.0.1 1.0.1 GHSA-phrq-v4q2-hmq6

Advisories 2

References