StyleSmuggler
StyleSmuggler (CVE-2026-75650, APSB26-146) is the critical unauthenticated remote code execution flaw in the Magento template engine, scored CVSS 10 and actively exploited in the wild since before the disclosure.
If you have not patched yet, stop reading and install the two pinned patches right now: the APSB26-146 hotfix that closes the RCE itself, and the APSB26-138 security update that ships alongside it. You need both, on every supported 2.4.x release. Mage-OS users get the same fix plus extra hardening in the 3.5.0 emergency release, and there are community backports for unsupported versions down to 2.2.
Because the vulnerability was exploited before the fix existed, patching alone is not enough: assume compromise, run the detection scripts collected here and rotate your credentials afterwards.
The rest of this page collects the community stop-gap patches, hardening modules, detection and cleanup tooling, and root cause analysis that landed during the first days. We keep updating this page as new information comes in.
-
Pinned
https://helpx.adobe.com/security/products/magento/apsb26-138.htmlOfficial bulletin for APSB26-138 detailing impacted versions, severity ratings, CVEs, and fixed releases. Only partial content was accessible during fetch; open the link for full details.
-
Pinned
https://helpx.adobe.com/security/products/magento/apsb26-146.htmlAnnounces a hotfix for CVE-2026-75650, a critical template engine vulnerability enabling unauthenticated remote code execution (CVSS 10) and known to be exploited. Lists affected 2.4.x and B2B releases and links to installation instructions.
-
https://github.com/disrex-group/module-stylesmuggler-guard
Adds interim, application-layer guards against the StyleSmuggler zero-day: validates URL-generator classes, blocks stream-wrapper template paths, sanitizes email template styles, and hardens reports/logs. Includes a block-directive allowlist and optional suppression of failed-payment emails; meant as defense-in-depth until an official fix.
-
https://gist.github.com/rhoerr/291d29ef3bd201c96757cf262d92bdaf
Diff introduces SecurePathValidator to reject stream/writable paths during template rendering, blocks backend/adminhtml blocks in {{block}} directives, and neutralizes PHP tags in error reports. Also tightens DI/setup scanners and grid URL generator type checks to avoid unsafe class/path resolution.
-
https://github.com/graycoreio/magento2-style-smuggler-patch
Composer-installable module that mitigates the Style Smuggler vulnerability by allowlisting email template {{block}} classes, validating grid row URL generator classes, and neutralizing Web API fatal error report output. Includes setup steps and di.xml examples to allowlist needed email blocks and guidance on checking logs for refused classes.
-
https://github.com/muench-dev/StyleSmuggler
Three bash scripts to scan for IoCs and guide cleanup on servers, apply community mitigations via Composer patches and a hardening module, and remotely check GraphQL exposure. Includes DDEV/Warden support, cloud-friendly usage, and step-by-step confirmations.
110 -
https://github.com/disrex-group/stylesmuggler-mitigation/tree/main
Step-by-step detection and cleanup for the unauthenticated RCE, plus nginx/Apache rules to block active campaigns and a Composer module/patch that makes DI scanners CLI-only (works on 2.4.6–2.4.9).
-
https://gist.github.com/ProxiBlue/07373c92c8c70dc746bbfdcd1f07b789
Patch enforcing CLI-only execution for DI scanners to mitigate StyleSmuggler, adding PHP_SAPI checks in ArrayScanner, ClassesScanner, and XmlInterceptorScanner.
-
https://github.com/brideo/stylesmuggler-patch
Stopgap hardening package for the Sansec‑disclosed StyleSmuggler RCE: Nginx/Apache request filters, a DI‑scanner CLI guard, a sanitizing module, and scripts for compromise checks, containment, and DB audits. Includes deployment, testing, and incident‑response runbooks; designed to be removed once an official fix ships.
12