Headline

CVE-2023-37473: Release v0.2.1 · zenstruck/collection

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings (ie system) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit f4b1c48820 and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either EntityRepository::find() or query().

1 year ago

CVE

Open in Source

#vulnerability #git

- Actions
  
  Automate any workflow
- Packages
  
  Host and manage packages
- Security
  
  Find and fix vulnerabilities
- Codespaces
  
  Instant dev environments
- Copilot
  
  Write better code with AI
- Code review
  
  Manage code changes
- Issues
  
  Plan and track work
- Discussions
  
  Collaborate outside of code

- GitHub Sponsors
  
  Fund open source developers

*   The ReadME Project
    
    GitHub community articles

Pricing

Search code, repositories, users, issues, pull requests…

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

### Impact Passing _callable strings_ (ie `system`) caused the function to be executed. ### Patches Fixed in [v0.2.1](https://github.com/zenstruck/collection/releases/tag/v0.2.1). ### Workarounds Do not allow passing user strings to `EntityRepository::find()` or `query()`. ### References [Fix commit](https://github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c).

1 year ago

ghsa

Open in Source

#git