Shared on Mage Dispatch · 08 Sep 2026
Pre-split APSB26-146 (VULN-39341) patches tailored for cweagans/composer-patches, organized per 2.4.4-p18 through 2.4.9 with a drop-in patches.json. Covers framework, base, backend, email, and newsletter packages, with steps to apply via Composer.
Announces a hotfix for CVE-2026-75650, a critical template engine vulnerability enabling unauthenticated remote code execution (CVSS 10) and known to be exploited. Lists affected 2.4.x and B2B releases and links to installation instructions.
Diff introduces SecurePathValidator to reject stream/writable paths during template rendering, blocks backend/adminhtml blocks in {{block}} directives, and neutralizes PHP tags in error reports. Also tightens DI/setup scanners and grid URL generator type checks to avoid unsafe class/path resolution.
Composer-installable module that mitigates the Style Smuggler vulnerability by allowlisting email template {{block}} classes, validating grid row URL generator classes, and neutralizing Web API fatal error report output. Includes setup steps and di.xml examples to allowlist needed email blocks and guidance on checking logs for refused classes.
Mage Dispatch is a community-run archive and bi-weekly newsletter for the Magento, Adobe Commerce and Mage-OS ecosystem. Modules, articles, security advisories and tools, hand-picked by developers and shared so good work does not disappear into the void.
Browse the latest links → Explore by topic → Submit a link → About us →
