CVE-2023-37473 Information

Description

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings (ie system) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit f4b1c48820 and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either EntityRepository::find() or query().

Reference

https://github.com/zenstruck/collection/releases/tag/v0.2.1 https://github.com/zenstruck/collection/security/advisories/GHSA-7xr2-8ff7-6fjq https://github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c