https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-26T20:20:38.240035+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2023-37473 CVE-2023-37473 — Limited code execution in zenstruck/collections 2026-10-26T20:20:38.241178+00:00

Affected: zenstruck collection

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`.