GHSA-7xr2-8ff7-6fjq
zenstruck/collection passing callable string to EntityRepository::find() and query()
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | zenstruck/collection | < 0.2.1 | 0.2.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Passing _callable strings_ (ie `system`) caused the function to be executed.
### Patches
Fixed in [v0.2.1](https://github.com/zenstruck/collection/releases/tag/v0.2.1).
### Workarounds
Do not allow passing user strings to `EntityRepository::find()` or `query()`.
### References
[Fix commit](https://github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c).
References
External links from the advisory. They lead to third-party sites.
- https://github.com/zenstruck/collection/security/advisories/GHSA-7xr2-8ff7-6fjq
- https://nvd.nist.gov/vuln/detail/CVE-2023-37473
- https://github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c
- https://github.com/zenstruck/collection
- https://github.com/zenstruck/collection/releases/tag/v0.2.1