[laravel/laravel] Remote Code Execution in Laravel

A Remote Code Execution (RCE) vulnerability exists in h laravel 5.8.38 via an unserialize pop chain in (1) __destruct in \Routing\PendingResourceRegistration.php, (2) __cal in Queue\Capsule\Manager.php, and (3) __invoke in mockery\library\Mockery\ClosureWrapper.php.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-43503
• https://github.com/guoyanan1g/Laravel-vul/issues/2#issue-1045655892
• https://github.com/advisories/GHSA-86r3-4gq8-xw8q