0X0Oz

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information.

An issue exists where an attacker can transform a redirect route rule using wildcards into a cross-host redirect by inserting an extra slash after the rule prefix. This occurs when the project uses `routeRules` with a `redirect` entry and the target uses a `/**` wildcard suffix to forward sub-paths. The Nitro runtime strips the rule prefix and joins the remainder against the target; if the remainder starts with `//`, it is preserved, leading the browser to resolve it as a protocol-relative URL to an external domain. This results in an open redirect where the target is fully controlled by the attacker. This issue does not affect deployments using `vercel`, `netlify`, `cloudflare-pages`, or `edgeone` presets, as those handle redirects at the CDN layer rather than through the Nitro runtime.