GHSA-7xr2-8ff7-6fjqHighCVSS 8.5

zenstruck/collection passing callable string to EntityRepository::find() and query()

Published
July 14, 2023
Last Modified
November 10, 2023

🔗 CVE IDs covered (1)

CVE-2023-37473 →

📋 Description

Impact

Passing callable strings (ie system) caused the function to be executed.

Patches

Fixed in v0.2.1.

Workarounds

Do not allow passing user strings to EntityRepository::find() or query().

References

Fix commit.

🎯 Affected products1

  • composer/zenstruck/collection:< 0.2.1

🔗 References (5)