{"action":"Upgrade hot-formula-parser to 3.0.1 or later.","affected":[{"fixed":"3.0.1","introduced":"0"}],"component":"hot-formula-parser","cve_ids":["CVE-2020-6836"],"ecosystem":"npm","epss":0.02148,"exploited":false,"fixed_versions":["3.0.1"],"ghsa_id":"GHSA-rc77-xxq6-4mff","id":"tcs_01M5KG8QX31901HJYVMAKVXC7N","modified_at":"2023-11-08T04:03:57.359747Z","published_at":"2020-05-06T19:32:33Z","references":["https://osv.dev/vulnerability/GHSA-rc77-xxq6-4mff","https://nvd.nist.gov/vuln/detail/CVE-2020-6836","https://github.com/handsontable/formula-parser/pull/58","https://github.com/handsontable/formula-parser/commit/396b089738d4bf30eb570a4fe6a188affa95cd5e","https://blog.truesec.com/2020/01/17/reverse-shell-through-a-node-js-math-parser","https://github.com/handsontable/formula-parser","https://www.npmjs.com/advisories/1439"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-rc77-xxq6-4mff","url":"https://osv.dev/vulnerability/GHSA-rc77-xxq6-4mff"}],"summary":"Command Injection in hot-formula-parser"}