StyleSmuggler: the Magento zero-day that runs code without authentication

What does this flaw actually do?

StyleSmuggler injects code into Magento’s template system. By going through the `styles` properties, the payload slips past the safeguards already in place on the rendering engine.

No account, no password, no admin interaction required. That is the worst case for an online store: a stranger gets code execution on the server that handles payments.

How does the attack unfold?

Exploitation happens in two stages. First, the attacker poisons the template, for instance by deliberately triggering a failure report.

Second, they trigger Magento’s standard "Payment Transaction Failed Reminder" email. The poisoned code runs while Magento renders the message, server-side. The email does not even need to be opened by a recipient.

Sansec reproduced the full unauthenticated chain on fresh installs of Magento Open Source 2.4.7, 2.4.8 and 2.4.9.

What does it cost a merchant?

Unauthenticated code execution leads straight to a dropped webshell, a card skimmer planted on the checkout page (Magecart), and exfiltration of the customer database.

Between the first attacks (4 September) and Adobe’s fix (7 September), the only variable you controlled was your exposure time. The hotfix now exists, but it still has to be deployed on every store - and every day of delay counts.

What should you do today?

Inventory your Magento and Adobe Commerce versions, including publicly reachable staging environments: the same automated scans hit them too.

Watch for new PHP files in media directories and for template changes. Blocking is not auditing: a store already compromised stays compromised after a filter goes up.

Filter the exploitation chain upstream to hold the line until the vendor fix lands: that is exactly what a virtual patch is for.