{"id":"GHSA-7xr2-8ff7-6fjq","aliases":["CVE-2023-37473"],"title":"zenstruck/collection passing callable string to EntityRepository::find() and query()","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"### Impact\nPassing _callable strings_ (ie `system`) caused the function to be executed.\n\n### Patches\nFixed in [v0.2.1](https://github.com/zenstruck/collection/releases/tag/v0.2.1).\n\n### Workarounds\nDo not allow passing user strings to `EntityRepository::find()` or `query()`.\n\n### References\n[Fix commit](https://github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c).\n","severity":"high","score":8.5,"published":"2023-07-14T21:59:13.000Z","modified":"2026-09-10T03:49:42.631Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"zenstruck/collection","sources":[{"name":"OSV · GHSA-7xr2-8ff7-6fjq","url":"https://osv.dev/vulnerability/GHSA-7xr2-8ff7-6fjq"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.2.1"}],"type":"ECOSYSTEM"}],"versions":["v0.1.0","v0.2.0"],"fixed":["0.2.1"]}],"sourceAffected":[],"references":["https://github.com/zenstruck/collection/security/advisories/GHSA-7xr2-8ff7-6fjq","https://nvd.nist.gov/vuln/detail/CVE-2023-37473","https://github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c","https://github.com/zenstruck/collection","https://github.com/zenstruck/collection/releases/tag/v0.2.1"],"sources":[{"name":"OSV","id":"GHSA-7xr2-8ff7-6fjq","modified":"2026-09-10T03:49:42.631460226Z","url":"https://osv.dev/vulnerability/GHSA-7xr2-8ff7-6fjq"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T22:15:33.378Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}