Shared on Mage Dispatch · 08 Sep 2026

StyleSmuggler Guard Module

Adds interim, application-layer guards against the StyleSmuggler zero-day: validates URL-generator classes, blocks stream-wrapper template paths, sanitizes email template styles, and hardens reports/logs. Includes a block-directive allowlist and optional suppression of failed-payment emails; meant as defense-in-depth until an official fix.

Visit link → https://github.com/disrex-group/module-stylesmuggler-guard

#security #vulnerability #templates #StyleSmuggler

More like this

APSB26-146 patches for cweagans/composer-patches

Pre-split APSB26-146 (VULN-39341) patches tailored for cweagans/composer-patches, organized per 2.4.4-p18 through 2.4.9 with a drop-in patches.json. Covers framework, base, backend, email, and newsletter packages, with steps to apply via Composer.

https://github.com/yellowteak/APSB26-146-patches

#security-patch #composer #cweagans-composer-patches #StyleSmuggler

08 Sep 2026
StyleSmuggler root cause: only sign directives that were explicitly deferred

Patch implementing explicit directive deferral and signing in the template filter to block unresolvable directives from being treated as deferred and executed by parent templates. Includes diffs for Framework Template and Email Template Filter, adapted for Composer installs and intended to be applied alongside APSB26-146.

https://gist.github.com/pingiun/00cfbfdc3cf517807eb3b6bc24c7f295

#security-patch #templates #email #StyleSmuggler

08 Sep 2026
CVE-2026-75650 / APSB26-146 Patch Analysis

Details how APSB26-146 closes three issues—unsafe object instantiation reachable from CMS/email templates, untyped preview inputs, and writable error reports—and outlines patching steps plus checks to catch similar instantiate-then-check anti-patterns.

https://dor.ky/post/cve-2026-75650-apsb26-patches-analysis

#security-patch #vulnerability #di #cms #StyleSmuggler

08 Sep 2026

New here? This is Mage Dispatch

Mage Dispatch is a community-run archive and bi-weekly newsletter for the Magento, Adobe Commerce and Mage-OS ecosystem. Modules, articles, security advisories and tools, hand-picked by developers and shared so good work does not disappear into the void.

Browse the latest links → Explore by topic → Submit a link → About us →

StyleSmuggler Guard Module

More like this

APSB26-146 patches for cweagans/composer-patches

StyleSmuggler root cause: only sign directives that were explicitly deferred

CVE-2026-75650 / APSB26-146 Patch Analysis

New here? This is Mage Dispatch

Never miss what's new in Magento land