Security vulnerabilities and automated fixes for configuration validation issues
1 post found
A critical vulnerability in Magento's Tailwind.php model allowed unvalidated user-influenced configuration to be written directly to files, potentially enabling code injection attacks. This fix introduces a new ConfigValidator class that sanitizes all configuration input before persistence, preventing attackers with database write access from injecting malicious payloads.