graycore / magento2-style-smuggler-patch

v2.0.0 2026-09-05 18:41 UTC

Requires

• magento/framework: ^102.0 || ^103.0
• magento/module-backend: ^101.0 || ^102.0
• magento/module-email: ^101.0 || ^101.1

Requires (Dev)

• magento/magento-coding-standard: ^40
• magento/php-compatibility-fork: ^0.1.0
• phpunit/phpunit: ^12.0
• squizlabs/php_codesniffer: ^3.0.0

MIT

• Damien Retzinger

Published on Packagist.org on 2026-09-05 18:41 UTC

README

Caution

This is an unofficial stop-gap, not an official Adobe patch, and it carries no warranty. See the LICENSE.

It hardens three points on the StyleSmuggler chain: the email template {{block}} directive refuses backend blocks, the grid row URL generator factory validates the class before building it, and Web API fatal error reports have their PHP open tags broken. That is hardening, not a fix — the vulnerability itself is unpatched, and other paths through it remain open.

A vulnerable store may already be compromised. Mitigating an entry point does not remove a backdoor that is already there. Audit your store.

The mitigation will change as better fixes are found. Read the CHANGELOG before every upgrade. Test on a staging environment first. Have a rollback plan.

Magento Version Support

Purpose

This repo creates a stop-gap patch for the Style Smuggler vulnerability. It's purely mitigation. It likely isn't perfect, but it's my current best assessment of how to mitigate the vulnerability.

This package will change versions as I trial different layers of fixes to the vulnerability.

Getting Started

This module is intended to be installed with composer. From the root of your Magento 2 project:

1. Download the package

composer require graycore/magento2-style-smuggler-patch

1. Enable the package

./bin/magento module:enable Graycore_StyleSmugglerPatch

Upgrading

• Semver Policy