templates
-
https://github.com/cresset-tools/module-template-parser
AST-based engine that renders {{...}} templates in a single pass to eliminate re-parsing bugs, with strict, lenient, and compatibility modes. Ships with a drop-in module and CLI to shadow-compare, diff, and safely roll out rendering across emails, CMS, and newsletters.
-
https://github.com/bigbridge-nl/magento2-stylesmuggler-deferred-directives-fix
Root-cause patch that restricts directive signing to explicitly deferred directives (like inlinecss), preventing signatures on unresolved directives exploited in the StyleSmuggler chain. Includes ready-to-apply patches for versions 2.4.5–2.4.9 and instructions for using composer-patches/cweagans.
-
https://gist.github.com/pingiun/00cfbfdc3cf517807eb3b6bc24c7f295
Patch implementing explicit directive deferral and signing in the template filter to block unresolvable directives from being treated as deferred and executed by parent templates. Includes diffs for Framework Template and Email Template Filter, adapted for Composer installs and intended to be applied alongside APSB26-146.
-
https://github.com/disrex-group/module-stylesmuggler-guard
Adds interim, application-layer guards against the StyleSmuggler zero-day: validates URL-generator classes, blocks stream-wrapper template paths, sanitizes email template styles, and hardens reports/logs. Includes a block-directive allowlist and optional suppression of failed-payment emails; meant as defense-in-depth until an official fix.
-
https://gist.github.com/rhoerr/291d29ef3bd201c96757cf262d92bdaf
Diff introduces SecurePathValidator to reject stream/writable paths during template rendering, blocks backend/adminhtml blocks in {{block}} directives, and neutralizes PHP tags in error reports. Also tightens DI/setup scanners and grid URL generator type checks to avoid unsafe class/path resolution.