Description
Versions of hot-formula-parser prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the parse function and concatenates it in an eval call. If a value of the formula is supplied by user-controlled input it may allow attackers to run arbitrary commands in the server.
Recommendation
Update the hot-formula-parser package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.1
- Patched version(s): 3.0.1
References
Could your website be exposed too?
SmartScanner can check your website for Command Injection in hot-formula-parser and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Injection and Command Injection in devcert - CVE-2020-8186
- karma-mojo enables OS Command Injection - CVE-2020-7626
- mcp-package-docs vulnerable to command injection in several tools - CVE-2025-54073
- electerm has Command Injection via runLinux funtion - CVE-2026-41501
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023