disrex / stylesmuggler-adobe-patches

3.0.0 2026-09-08 10:56 UTC

Requires

• php: >=7.4
• composer-plugin-api: ^2.0

MIT

• Rick Bouma

• security
• magento
• patch
• mage-os
• apsb26-146
• cve-2026-75650
• stylesmuggler

Published on Packagist.org on 2026-09-08 14:01 UTC

README

A Composer plugin that applies Adobe's official APSB26-146 fix (CVE-2026-75650, internal reference VULN-39341) for the StyleSmuggler zero-day to Magento Open Source and Mage-OS, automatically, detecting your installed version.

It patches the installed packages itself on install and update. It does not rely on cweagans/composer-patches or a root enable-patching flag, so it cannot silently do nothing the way a dependency patch does on composer-patches v1.

Prefer a release that already contains the fix. If you can move to a Magento or Mage-OS release that ships APSB26-146, do that. This plugin is for a store that must patch in place.

Install

composer require disrex/stylesmuggler-adobe-patches

You must allow the plugin, or nothing is patched. Because this is a Composer plugin, Composer 2.2 and later ask:

Do you trust "disrex/stylesmuggler-adobe-patches" to execute code and wish to enable it now? [y,n,d,?]

Answer y. If you answer n, or run non-interactively (CI, --no-interaction) without allowing it first, Composer skips the plugin and your store is not patched. To allow it ahead of time (required for CI and deploys), add this to your root composer.json before installing:

"config": { "allow-plugins": { "disrex/stylesmuggler-adobe-patches": true } }

On the next composer install or composer update the plugin applies the patch and prints what it did:

  StyleSmuggler (APSB26-146): applying magento_framework.patch
  ...
✅ StyleSmuggler (APSB26-146) patched: Magento 2.4.8.

What it does

On post-install-cmd and post-update-cmd it:

1. Detects the store: magento/product-community-edition (Magento) or mage-os/product-community-edition (Mage-OS), falling back to magento/framework.
2. Picks the patch set for your Magento line (2.4.4 through 2.4.9). If your exact version has no set, it tries the closest one rather than giving up.
3. Applies Adobe's patch to framework, module-backend, module-email, module-newsletter and the error-report processor, under the right vendor (magento/ or mage-os/).

It is idempotent: an already-patched store reports already applied and nothing changes.

Safe by construction

• It never touches your Magento or Mage-OS packages' versions. It only edits files that are already installed. Requiring it adds the plugin, nothing else.
• patch is strict. A hunk applies only where the surrounding lines match exactly, so the fix cannot land in the wrong place. On a version it was not built against, a mismatch is reported as a loud error, not applied silently and not hidden.
• A failure is loud. If any hunk fails, the plugin prints a red error saying the store may still be vulnerable, so a broken patch cannot pass unnoticed. For a security fix that matters more than a clean log.

Coverage

Adobe's patch is built per Magento patch level; this plugin ships all of them and picks by your version. Verified end to end on Magento 2.4.8, and the framework patch verified against Mage-OS framework 2.3.0 (Magento 2.4.8-p5) and 3.4.0 (Magento 2.4.9). Other patch levels rely on patch's strictness: they apply where the files are unchanged and report a mismatch otherwise.

Magento line	Adobe patch built against
2.4.4	2.4.4-p18
2.4.5	2.4.5-p17
2.4.6	2.4.6-p15
2.4.7	2.4.7-p10
2.4.8	2.4.8-p5
2.4.9	2.4.9

Mage-OS lines map to these by the Magento version they track.

Remove once you upgrade

composer remove disrex/stylesmuggler-adobe-patches

This stops re-applying the patch. It does not revert files already patched; move to a release that contains the fix and reinstall to get clean vendor files.

After patching a store that was exposed

Patching shuts the door; it does not evict an attacker who already got in or invalidate secrets they read. If you found any indicator of compromise, rotate the encryption key, database and admin credentials, API tokens and payment-gateway keys, and work through the cleanup guide in the mitigation repo.

Credits and license

The fix is Adobe's (APSB26-146). The patch files under patches/ are Adobe's VULN-39341, repackaged for per-package application by yellowteak. Discovery and the original advisory belong to Sansec. This plugin's own code is MIT; the patch content under patches/ is Adobe's, not covered by that license.