Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling

Summary

### Impact

Versions of the Algolia Search & Discovery extension for Magento 2 prior to **3.17.2** and **3.16.2** contain a vulnerability where data read from the database was treated as a trusted source during job execution.

If an attacker is able to modify records used by the extension’s indexing queue, this could result in **arbitrary PHP code execution** when the affected job is processed.

Exploitation requires the ability to write malicious data to the Magento database and for the indexing queue to be enabled.

---

### Patches

This vulnerability has been fixed in the following versions:

- **3.17.2** - **3.16.2**

Merchants should upgrade to a supported patched version immediately.

Versions outside the supported maintenance window do **not** receive security updates and remain vulnerable.

---

### Workarounds

Upgrading to a patched version is the only recommended remediation.

If an immediate upgrade is not possible, the following temporary risk mitigations may reduce exposure:

- Disable the Algolia indexing queue to prevent queued jobs from being executed. - Restrict job execution logic to an explicit allowlist of permitted operations. - Review the contents of the `algoliasearch_queue` table for unexpected or unrecognized entries. - If queue archiving is enabled, review historical records in `algoliasearch_queue_archive`.

These mitigations are provided as guidance only and do not replace upgrading to a patched version.

---

### References

- Algolia Search & Discovery for Magento 2 releases: - [3.16.2](https://github.com/algolia/algoliasearch-magento-2/releases/tag/3.16.2) - [3.17.2](https://github.com/algolia/algoliasearch-magento-2/releases/tag/3.17.2)