Skip to content

Passing callable string to EntityRepository::find() and query()

Moderate
kbond published GHSA-7xr2-8ff7-6fjq Jul 14, 2023

Package

composer zenstruck/collection (Composer)

Affected versions

<0.2.1

Patched versions

0.2.1

Description

Impact

Passing callable strings (ie system) caused the function to be executed.

Patches

Fixed in v0.2.1.

Workarounds

Do not allow passing user strings to EntityRepository::find() or query().

References

Fix commit.

Severity

Moderate

CVE ID

CVE-2023-37473

Weaknesses

No CWEs

Credits