CVE-2020-6836
Critical
Description
grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may allow attackers to run arbitrary commands on the server.
SeverityCritical
CVSS9.8
Exploit probability—
ProductHot-formula-parser
PublishedJan 11, 2020
First seenJan 11, 2020
How to fix
Update
- hot-formula-parser_project hot-formula-parser3.0.1 or later
- hot-formula-parser3.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hot-formula-parser_project hot-formula-parser | v < 3.0.1 | 3.0.1 |
| hot-formula-parsernpm | v < 3.0.1 | 3.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.