Lucene search
PRIOn knowledge basePRION:CVE-2020-6836HistoryJan 11, 2020 - 1:15 a.m.
Code injection
2020-01-1101:15:00
PRIOn knowledge base
www.prio-n.com
2
grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may allow attackers to run arbitrary commands on the server.
| CPE | Name | Operator | Version |
|---|---|---|---|
| hot-formula-parser | lt | 3.0.1 |
Related
osv
osv
CVE-2020-6836
2020-01-11 01:15:10
Command Injection in hot-formula-parser
2020-05-06 19:32:33
nvd
nvd
CVE-2020-6836
2020-01-11 01:15:10
veracode
veracode
Arbitrary Code Injection
2020-01-13 00:54:16
nodejs
nodejs
Command Injection
2019-12-18 14:29:51
githubexploit
githubexploit
Exploit for Code Injection in Hot-Formula-Parser Project Hot-Formula-Parser
2020-12-01 09:45:48
cve
cve
CVE-2020-6836
2020-01-11 01:15:10
cvelist
cvelist
CVE-2020-6836
2020-01-11 00:42:28
github
github
Command Injection in hot-formula-parser
2020-05-06 19:32:33