CVE-2023-37473

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
zenstruck	collection	< 0.2.1
zenstruck	collection	< 0.2.1

References

Timeline

Published: Jul 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-374747.5Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder.CVE-2023-374757.5Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to CVE-2023-374767.8OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger CVE-2023-374778.81Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel fir CVE-2023-374789.8pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when in CVE-2023-374797.5Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environmen CVE-2023-37487.5A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an at CVE-2023-374804.9Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vuln CVE-2023-374814.9Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vuln CVE-2023-374825.3The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated re CVE-2023-374839.8SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against CVE-2023-374845.3SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during logi