high8.5
CVE-2023-37473
zenstruck/collection passing callable string to EntityRepository::find() and query()
Impact
### Impact Passing _callable strings_ (ie `system`) caused the function to be executed. ### Patches Fixed in [v0.2.1](https://github.com/zenstruck/collection/releases/tag/v0.2.1). ### Workarounds Do not allow passing user strings to `EntityRepository::find()` or `query()`. ### References [Fix commit](https://github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | zenstruck/collection | < 0.2.1 | 0.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zenstruck | Collection | Version 0.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c
- https://github.com/zenstruck/collection/releases/tag/v0.2.1
- https://github.com/zenstruck/collection/security/advisories/GHSA-7xr2-8ff7-6fjq
- https://github.com/advisories/GHSA-7xr2-8ff7-6fjq
- https://nvd.nist.gov/vuln/detail/CVE-2023-37473