Loading vulnerability…
BlockStrap (CVE-2026-103849) is a second-pass template directive injection vulnerability affecting Adobe Commerce and Magento Open Source through version 2.4.9 and Adobe Commerce B2B through version 1.5.3 in unpatched releases. The email-template engine can sign attacker-controlled content within a child template and subsequently reprocess it at the root level, allowing a smuggled block directive to execute within the rendering process. This behavior bypasses protections introduced by the separate StyleSmuggler fix and permits unauthenticated remote arbitrary PHP code execution without user interaction. The vulnerability has a reported CVSS 3.1 score of 10.0.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A maximum-severity, second-pass email-template directive injection vulnerability that can execute arbitrary PHP code. Attacker-controlled content in a child email template can be signed and processed again at the root level, executing a smuggled {{block}} directive. Sansec identified four potential attack paths but had not observed attacks. Administrators must apply the 2026-oct release or Adobe's isolated patch; a plain Composer install is insufficient. The separate September StyleSmuggler hotfix must remain installed.
A critical second-pass directive injection in Magento's email template engine that allows unauthenticated attackers to execute arbitrary PHP on the store server. Attacker-controlled child-template data can be signed and rescanned at the root level despite the earlier StyleSmuggler hotfix. Adobe's October patch replaces the generic rescan with registered placeholders.
A template-engine vulnerability in Adobe Commerce could allow arbitrary code execution in the current user's context, potentially granting elevated access or control over the victim's account or session. Exploitation requires no user interaction, and the advisory reports changed scope.
A critical template-engine vulnerability affecting Adobe Commerce, Magento Open Source, and Adobe Commerce B2B. The reference reports remote exploitability, arbitrary code execution in the current user's context, potential elevated access or account/session control, and no required user interaction. It assigns a CVSS 3.1 score of 10.0. Affected versions are not specified.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.