CVE-2020-13756

CVE-2020-13756 is a critical remote code execution vulnerability affecting the Sabberworm PHP CSS Parser prior to version 8.3.1. It arises from the parser's use of eval on uncontrolled input when specific functions like allSelectors() or getSelectorsBySpecificity() are invoked. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with low attack complexity and no user interaction, potentially leading to complete compromise of confidentiality, integrity, and availability. While there are no known public exploits or active exploitation in the wild, the vulnerability has garnered significant community discussion and media coverage, indicating awareness despite its inactive status on the CISA KEV catalog.