AIKIDO-2025-10913

TL;DR

Affected versions of this package are vulnerable to Remote Code Execution due to insufficient validation of the $arrow parameter in the groupFilter method, where the old code allowed an unvalidated callable or string to be executed. An attacker could potentially exploit this by passing crafted malicious input that gets executed as code, leading to arbitrary command execution on the server. The patch mitigates this by implementing a validation check via self::checkArrowFunction() before processing the parameter.