Summary
Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling
Workarounds
Upgrading to a patched version is the only recommended remediation.
If an immediate upgrade is not possible, the following temporary risk mitigations may reduce exposure:
- Disable the Algolia indexing queue to prevent queued jobs from being executed.
- Restrict job execution logic to an explicit allowlist of permitted operations.
- Review the contents of the
algoliasearch_queuetable for unexpected or unrecognized entries. - If queue archiving is enabled, review historical records in
algoliasearch_queue_archive.
These mitigations are provided as guidance only and do not replace upgrading to a patched version.
References
Impact
Versions of the Algolia Search & Discovery extension for Magento 2 prior to 3.17.2 and 3.16.2 contain a vulnerability where data read from the database was treated as a trusted source during job execution.
If an attacker is able to modify records used by the extension’s indexing queue, this could result in arbitrary PHP code execution when the affected job is processed.
Exploitation requires the ability to write malicious data to the Magento database and for the indexing queue to be enabled.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
This vulnerability has been fixed in the following versions:
- 3.17.2
- 3.16.2
Merchants should upgrade to a supported patched version immediately.
Versions outside the supported maintenance window do not receive security updates and remain vulnerable.
Frequently Asked Questions
- What is GHSA-595P-G7XC-C333? GHSA-595P-G7XC-C333 is a medium-severity security vulnerability in algolia/algoliasearch-magento-2 (composer), affecting versions >= 3.17.0-beta.1, <= 3.17.1. It is fixed in 3.17.2, 3.16.2.
- Which versions of algolia/algoliasearch-magento-2 are affected by GHSA-595P-G7XC-C333? algolia/algoliasearch-magento-2 (composer) versions >= 3.17.0-beta.1, <= 3.17.1 is affected.
- Is there a fix for GHSA-595P-G7XC-C333? Yes. GHSA-595P-G7XC-C333 is fixed in 3.17.2, 3.16.2. Upgrade to this version or later.
- Is GHSA-595P-G7XC-C333 exploitable, and should I be worried? Whether GHSA-595P-G7XC-C333 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-595P-G7XC-C333 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-595P-G7XC-C333?
- Upgrade
algolia/algoliasearch-magento-2to 3.17.2 or later - Upgrade
algolia/algoliasearch-magento-2to 3.16.2 or later
- Upgrade