Command Injection in hot-formula-parser

Description

Versions of hot-formula-parser prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the parse function and concatenates it in an eval call. If a value of the formula is supplied by user-controlled input it may allow attackers to run arbitrary commands in the server.

Recommendation

Update the hot-formula-parser package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.0.1
• Patched version(s): 3.0.1

References

• GHSA-rc77-xxq6-4mff
• blog.truesec.com
• www.npmjs.com
• CVE-2020-6836
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Injection and Command Injection in devcert - CVE-2020-8186
• karma-mojo enables OS Command Injection - CVE-2020-7626
• mcp-package-docs vulnerable to command injection in several tools - CVE-2025-54073
• electerm has Command Injection via runLinux funtion - CVE-2026-41501

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

hot-formula-parser