CVE-2020-13756: Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code exe...

Security readout for executives and security teams

This flaw is in Sabberworm PHP CSS Parser before 8.3.1. Under specific use, attacker-controlled CSS can reach an eval call, creating possible remote code execution. Business risk is highest for PHP applications that parse untrusted CSS and call the named selector APIs. Likely exposure is PHP applications or distributions using Sabberworm PHP CSS Parser below 8.3.1, especially where users can submit CSS or HTML/CSS content processed by the parser. Prioritize remediation for public-facing or multi-tenant systems that accept user-controlled styling content. For internal systems without untrusted CSS parsing, urgency is lower but dependency cleanup should still be tracked. Mitigation focus: Upgrade Sabberworm PHP CSS Parser to 8.3.1 or later where available.; Review Debian LTS guidance if using packaged Debian versions.; Block attacker-controlled CSS from reaching the affected selector APIs until upgraded..

Prepared

Jun 5, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.