GHSA-7xr2-8ff7-6fjqhigh8.5
zenstruck/collection passing callable string to EntityRepository::find() and query()
Impact
Passing _callable strings_ (ie system) caused the function to be executed.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
zenstruck/collection Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 0.2.1Ecosystem versions | 0.2.1 |
Version evidence: OSV · GHSA-7xr2-8ff7-6fjq
View original version evidence (2 explicit versions)
Original source description
Impact
Passing callable strings (ie system) caused the function to be executed.
Patches
Fixed in v0.2.1.
Workarounds
Do not allow passing user strings to EntityRepository::find() or query().
References
References
- Security advisory github.com/zenstruck/collection/security/advisories/GHSA-7xr2-8ff7-6fjq
- Security advisory nvd.nist.gov/vuln/detail/CVE-2023-37473
- Patch github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c
- Source reference github.com/zenstruck/collection
- Release notes github.com/zenstruck/collection/releases/tag/v0.2.1