High severity8.5NVD Advisory· Published Jul 14, 2023· Updated Jun 17, 2026
CVE-2023-37473
CVE-2023-37473
Description
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie system) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit f4b1c48820 and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either EntityRepository::find() or query().
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
zenstruck/collectionPackagist | < 0.2.1 | 0.2.1 |
Affected products
3- Range: < 0.2.1
- cpe:2.3:a:zenstruck:collection:0.2.1:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
5- github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19cnvdPatchWEB
- github.com/advisories/GHSA-7xr2-8ff7-6fjqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-37473ghsaADVISORY
- github.com/zenstruck/collection/releases/tag/v0.2.1nvdRelease NotesWEB
- github.com/zenstruck/collection/security/advisories/GHSA-7xr2-8ff7-6fjqnvdMitigationWEB
News mentions
0No linked articles in our index yet.