{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Adobe Commerce / Magento \"BlockStrap\": unauthenticated template-injection RCE (CVE-2026-103849) · updates",
  "home_page_url": "https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849",
  "feed_url": "https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849/feed.json",
  "description": "BlockStrap (CVE-2026-103849, CVSS 10.0) is a second-pass email-template directive injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker smuggle a {{block}} directive and run PHP code on the store server. It affects versions through 2.4.9 (September builds) and Adobe Commerce B2B through 1.5.3, and closes a gap left by the earlier StyleSmuggler fix. Adobe fixed it in APSB26-153 on Oct 13 as a priority 2 update with no known exploits; Sansec says the rating understates the risk because it found four attack paths within a day and StyleSmuggler went from hotfix to mass exploitation in three days.",
  "language": "en",
  "_pwn": {
    "slug": "adobe-commerce-magento-blockstrap-cve-2026-103849",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849/feed.xml",
    "llms": "https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849/llms.txt",
    "json": "https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849#2026-10-15-e9ac2c7c",
      "url": "https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849#2026-10-15-e9ac2c7c",
      "title": "Adobe Commerce / Magento \"BlockStrap\": unauthenticated template-injection RCE (CVE-2026-103849): Sansec names the bug BlockStrap after reproducing four code-execution routes within 24 hours of the patch, and warns exploitation is likely soon; no attacks on live stores yet.",
      "content_text": "Adobe Commerce / Magento \"BlockStrap\": unauthenticated template-injection RCE (CVE-2026-103849): Sansec names the bug BlockStrap after reproducing four code-execution routes within 24 hours of the patch, and warns exploitation is likely soon; no attacks on live stores yet.\n\nSource: https://sansec.io/research/blockstrap-magento-rce",
      "date_published": "2026-10-15T00:00:00.000Z",
      "external_url": "https://sansec.io/research/blockstrap-magento-rce",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849#2026-10-13-1bd57d44",
      "url": "https://pwn.watch/i/adobe-commerce-magento-blockstrap-cve-2026-103849#2026-10-13-1bd57d44",
      "title": "Adobe Commerce / Magento \"BlockStrap\": unauthenticated template-injection RCE (CVE-2026-103849): Adobe publishes APSB26-153 fixing CVE-2026-103849 and other critical, high and medium bugs; not aware of exploits.",
      "content_text": "Adobe Commerce / Magento \"BlockStrap\": unauthenticated template-injection RCE (CVE-2026-103849): Adobe publishes APSB26-153 fixing CVE-2026-103849 and other critical, high and medium bugs; not aware of exploits.\n\nSource: https://www.adobe.com/trust/security/products/commerce/apsb26-153.html",
      "date_published": "2026-10-13T00:00:00.000Z",
      "external_url": "https://www.adobe.com/trust/security/products/commerce/apsb26-153.html",
      "tags": [
        "critical"
      ]
    }
  ]
}