Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| sabberworm/php-css-parser(Packagist) | 8.3.0 | 8.3.1 | N/A |
| sabberworm/php-css-parser(Packagist) | 8.2.0 | 8.2.1 | N/A |
| sabberworm/php-css-parser(Packagist) | 8.1.0 | 8.1.1 | N/A |
| sabberworm/php-css-parser(Packagist) | 8.0.0 | 8.0.1 | N/A |
| sabberworm/php-css-parser(Packagist) | 7.0.0 | 7.0.4 | N/A |
| sabberworm/php-css-parser(Packagist) | 6.0.0 | 6.0.2 | N/A |
| sabberworm/php-css-parser(Packagist) | 5.2.0 | 5.2.1 | N/A |
| sabberworm/php-css-parser(Packagist) | 5.1.0 | 5.1.3 | N/A |
| sabberworm/php-css-parser(Packagist) | 5.0.0 | 5.0.9 | N/A |
| sabberworm/php-css-parser(Packagist) | 4.0.0 | 4.0.1 | N/A |
| sabberworm/php-css-parser(Packagist) | 3.0.0 | 3.0.1 | N/A |
| sabberworm/php-css-parser(Packagist) | 2.0.0 | 2.0.1 | N/A |
| sabberworm/php-css-parser(Packagist) | 1.0.0 | 1.0.1 | N/A |
CVSS Metrics
