Threats affecting pkg:github/rConfig Core

rConfig Core versions 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 have a critical deserialization of untrusted data vulnerability. This flaw allows unauthenticated network attackers to execute arbitrary code by pushing crafted serialized jobs onto the Redis-backed Laravel Horizon queue, which lacks authentication in affected deployments. Exploitation enables attackers to run arbitrary PHP and OS commands, write persistent web shells, and access sensitive credentials. The vulnerability is fixed in versions 8.2.19 and 8.4.1.