3
Magento 2 is a PHP framework. Log4j is a (vulnerable) Java dependency. As PHP does not include any Java dependencies, you are not exploited by this try of an attack.
2
This error in GSC is terribly vague and it is really hard to know what they are referring to when you see this in the reports. So, don't feel alone in finding this report confusing! When you see this report, you have to step through and see if you can find what error Google is flagging. Keep in mind, it can be a false positive too where Googlebot caught ...
Only top voted, non community-wiki answers of a minimum length are eligible