npm/hot-formula-parser CVE-2020-6836: critical 9.8, EPSS 2.15%
Command Injection in hot-formula-parser
Action: Upgrade hot-formula-parser to 3.0.1 or later.
npm i hot-formula-parser@3.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.0.1 | - |
Fixed versions
| 3.0.1 |
Sources
- osv: GHSA-rc77-xxq6-4mff
- https://nvd.nist.gov/vuln/detail/CVE-2020-6836
- https://github.com/handsontable/formula-parser/pull/58
- https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e
- https://blog.truesec.com/2020/01/17/reverse-shell-through-a-node-js-math-parser
- https://github.com/handsontable/formula-parser
- https://www.npmjs.com/advisories/1439
CVE-2020-6836 · published · modified · JSON