CVE-2020-6836 Command Injection in hot-formula-parser
Attackers can execute arbitrary code on the server by injecting malicious formulas into the hot-formula-parser package due to unsanitized input in eval calls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-6836?
CVE-2020-6836 is a critical code injection vulnerability in n/a, published on 11 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may allow attackers to run arbitrary commands on the server.
Weakness: CWE-94
Which versions are affected by CVE-2020-6836?
2 open source packages ship an affected version, including hot-formula-parser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hot-formula-parser npm | All versions | 3.0.1 |
hot-formula-parser npm | All versions | 3.0.1 |
Products include Hot-Formula-Parser Project Hot-Formula-Parser.
How do I fix CVE-2020-6836?
Upgrade hot-formula-parser to 3.0.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-6836 being exploited?
There is no known exploitation of CVE-2020-6836 in the wild and no public exploit code.
Sources
Also known as GHSA-rc77-xxq6-4mff.