Critical BlockStrap flaw lets hackers run code on Magento servers
Read original article ↗AI Summary
A critical vulnerability dubbed BlockStrap (CVE-2026-103849) affects Magento and Adobe Commerce platforms, allowing remote attackers to execute arbitrary PHP code on server systems through a second-pass template injection in email templates. The flaw exists due to improper neutralization of special elements in the template engine, enabling attacker-controlled content to be re-processed at root level, executing malicious {{block}} directives. Although active exploitation has not yet been observed, researchers warn that the complexity of the attack path is mitigated by AI tools that can rapidly reverse-engineer working exploits from patches, making mass exploitation likely in the near term. The vulnerability impacts Magento Open Source and Adobe Commerce up to version 2.4.9 and Adobe Commerce B2B up to 1.5.3, requiring both the BlockStrap and prior StyleSmuggler fixes to be applied for full protection.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.