GHSA-595P-G7XC-C333

Queue Jumping to RCE: Algolia for Magento 2 Object Instantiation

Alon Barad
Alon Barad
Software Engineer

Jan 14, 2026·6 min read·8 visits

Executive Summary (TL;DR)

The Algolia Magento 2 extension trusts database content too much. It uses a custom SQL-based queue system where the class name and method to be executed are stored as plain text. If an attacker can inject a row into this table (via SQL Injection or compromised DB credentials), they can trigger the Magento ObjectManager to execute any public method on any class in the codebase, leading to immediate RCE. The fix implements a strict whitelist of allowed handlers.

A critical vulnerability in the Algolia Search & Discovery extension for Magento 2 allows for Remote Code Execution via insecure handling of queue jobs. By manipulating the `algoliasearch_queue` table, an attacker can force the application to instantiate arbitrary classes and execute arbitrary methods.

Fix Analysis (1)

Technical Appendix

CVSS Score
9.1/ 10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Probability
0.04%
Top 100% most exploited

Affected Systems

Algolia Search & Discovery for Magento 2 < 3.16.2Algolia Search & Discovery for Magento 2 < 3.17.2

Affected Versions Detail

Product
Affected Versions
Fixed Version
Algolia Search & Discovery for Magento 2
Algolia
< 3.16.23.16.2
Algolia Search & Discovery for Magento 2
Algolia
< 3.17.23.17.2
AttributeDetail
Vulnerability TypeUntrusted Data Handling / Insecure Deserialization
CWE IDCWE-470
Attack VectorLocal/Network (via Database Access)
ImpactRemote Code Execution (RCE)
CVSS Score (Est.)9.1 (Critical)
Exploit StatusPoC Available (Theoretical)
CWE-470
Use of Externally-Controlled Input to Select Classes or Code

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Vulnerability Timeline

Patch released in versions 3.16.2 and 3.17.2
2024-12-11
GHSA-595p-g7xc-c333 published
2024-12-20