#StyleSmuggler Zero-Day (CVE-2026-75650)

diff --git a/vendor/magento/framework/View/Element/BlockFactory.php b/vendor/magento/framework/View/Element/BlockFactory.php
--- a/vendor/magento/framework/View/Element/BlockFactory.php
+++ b/vendor/magento/framework/View/Element/BlockFactory.php
@@ -41,6 +41,18 @@
     public function createBlock($blockName, array $arguments = [])
     {
         $blockName = ltrim($blockName, '\\');
+        // Validate the resolved type before instantiating: the stock order runs an
+        // arbitrary caller-supplied constructor before the type check rejects it.
+        if (!is_string($blockName) || $blockName === '') {
+            throw new \LogicException('Block name must be a non-empty string');
+        }
+        $omConfig = \Magento\Framework\App\ObjectManager::getInstance()
+            ->get(\Magento\Framework\ObjectManager\ConfigInterface::class);
+        $instanceType = $omConfig->getInstanceType($omConfig->getPreference($blockName));
+        if (!is_subclass_of($instanceType, BlockInterface::class)) {
+            throw new \LogicException($blockName . ' does not implement BlockInterface');
+        }
+
         $block = $this->objectManager->create($blockName, $arguments);
         if (!$block instanceof BlockInterface) {
             throw new \LogicException($blockName . ' does not implement BlockInterface');
diff --git a/vendor/magento/module-backend/Model/Widget/Grid/Row/UrlGeneratorFactory.php b/vendor/magento/module-backend/Model/Widget/Grid/Row/UrlGeneratorFactory.php
--- a/vendor/magento/module-backend/Model/Widget/Grid/Row/UrlGeneratorFactory.php
+++ b/vendor/magento/module-backend/Model/Widget/Grid/Row/UrlGeneratorFactory.php
@@ -36,6 +36,18 @@
      */
     public function createUrlGenerator($generatorClassName, array $arguments = [])
     {
+        if (!is_string($generatorClassName) || $generatorClassName === '') {
+            throw new \InvalidArgumentException('Passed wrong parameters');
+        }
+        // Validate the resolved type before instantiating; the post-construction
+        // check below is kept so both invariants hold.
+        $omConfig = \Magento\Framework\App\ObjectManager::getInstance()
+            ->get(\Magento\Framework\ObjectManager\ConfigInterface::class);
+        $instanceType = $omConfig->getInstanceType($omConfig->getPreference($generatorClassName));
+        if (!is_subclass_of($instanceType, \Magento\Backend\Model\Widget\Grid\Row\GeneratorInterface::class)) {
+            throw new \InvalidArgumentException('Passed wrong parameters');
+        }
+
         $rowUrlGenerator = $this->_objectManager->create($generatorClassName, $arguments);
         if (false === $rowUrlGenerator instanceof \Magento\Backend\Model\Widget\Grid\Row\GeneratorInterface) {
             throw new \InvalidArgumentException('Passed wrong parameters');
diff --git a/vendor/magento/module-email/Model/Template/Filter.php b/vendor/magento/module-email/Model/Template/Filter.php
--- a/vendor/magento/module-email/Model/Template/Filter.php
+++ b/vendor/magento/module-email/Model/Template/Filter.php
@@ -408,6 +408,14 @@
     {
         $skipParams = ['class', 'id', 'output'];
         $blockParameters = $this->getParameters($construction[2]);
+
+        // Authored {{block}} params are always scalar; a non-scalar only arrives
+        // through $var substitution, which is how attacker constructor data gets in.
+        foreach ($blockParameters as $blockParameterValue) {
+            if ($blockParameterValue !== null && !is_scalar($blockParameterValue)) {
+                return '';
+            }
+        }

         $block = null;

diff --git a/vendor/magento/framework/Logger/Handler/Base.php b/vendor/magento/framework/Logger/Handler/Base.php
--- a/vendor/magento/framework/Logger/Handler/Base.php
+++ b/vendor/magento/framework/Logger/Handler/Base.php
@@ -95,6 +95,16 @@
             $this->filesystem->createDirectory($logDir);
         }

+        // StyleSmuggler containment: neutralise PHP open tags so a poisoned log
+        // file is inert whichever include gadget reaches it.
+        if (isset($record['formatted']) && is_string($record['formatted'])) {
+            $record['formatted'] = str_replace(
+                ['<?', '<%'],
+                ['&lt;?', '&lt;%'],
+                $record['formatted']
+            );
+        }
+
         parent::write($record);
     }

diff --git a/vendor/magento/framework/Webapi/ErrorProcessor.php b/vendor/magento/framework/Webapi/ErrorProcessor.php
--- a/vendor/magento/framework/Webapi/ErrorProcessor.php
+++ b/vendor/magento/framework/Webapi/ErrorProcessor.php
@@ -17,6 +17,7 @@
 use Magento\Framework\Exception\NoSuchEntityException;
 use Magento\Framework\Phrase;
 use Magento\Framework\Serialize\Serializer\Json;
+use Magento\Framework\Serialize\Serializer\JsonHexTag;
 use Magento\Framework\Webapi\Exception as WebapiException;

 /**
@@ -96,7 +97,7 @@
         $this->_logger = $logger;
         $this->_filesystem = $filesystem;
         $this->directoryWrite = $this->_filesystem->getDirectoryWrite(DirectoryList::VAR_DIR);
-        $this->serializer = $serializer ?: ObjectManager::getInstance()->get(Json::class);
+        $this->serializer = $serializer ?: ObjectManager::getInstance()->get(JsonHexTag::class);
         $this->registerShutdownFunction();
     }

diff --git a/pub/errors/processor.php b/pub/errors/processor.php
--- a/pub/errors/processor.php
+++ b/pub/errors/processor.php
@@ -8,7 +8,7 @@
 namespace Magento\Framework\Error;

 use Magento\Config\Model\Config\Reader\Source\Deployed\DocumentRoot;
-use Magento\Framework\Serialize\Serializer\Json;
+use Magento\Framework\Serialize\Serializer\JsonHexTag;
 use Magento\Framework\Escaper;
 use Magento\Framework\App\ObjectManager;
 use Magento\Framework\App\Response\Http;
@@ -156,7 +156,7 @@
     /**
      * JSON serializer
      *
-     * @var Json
+     * @var JsonHexTag
      */
     private $serializer;

@@ -172,7 +172,7 @@

     /**
      * @param Http $response
-     * @param Json $serializer
+     * @param JsonHexTag $serializer
      * @param Escaper $escaper
      * @param DocumentRoot|null $documentRoot
      */
@@ -185,7 +185,7 @@
         $this->_response = $response;
         $this->_errorDir  = __DIR__ . '/';
         $this->_reportDir = dirname(dirname($this->_errorDir)) . '/var/report/';
-        $this->serializer = $serializer ?: ObjectManager::getInstance()->get(Json::class);
+        $this->serializer = $serializer ?: ObjectManager::getInstance()->get(JsonHexTag::class);
         $this->escaper = $escaper ?: ObjectManager::getInstance()->get(Escaper::class);
         $this->documentRoot = $documentRoot ?? ObjectManager::getInstance()->get(DocumentRoot::class);
         if (!empty($_SERVER['SCRIPT_NAME'])) {

Six changes.

• BlockFactory::createBlock() — resolve preferences and virtual types, check BlockInterface before instantiating. Stock order instantiates first, so the constructor has already run by the time the check fails.
• UrlGeneratorFactory::createUrlGenerator() — same bug, same fix.
• Filter::blockDirective() — reject non-scalar {{block}} parameters. Removes the primitive rather than one gadget.
• Report serializers — JsonHexTag on both writers, so new var/report files carry no raw PHP tags.
• Logger\Handler\Base::write() — escape PHP open tags, so a poisoned var/log file is inert.

The last two are defence in depth, not the fix. The write side is not reliably containable.

Dropped from revision 1: Io::includeFile(), the three DI scanner guards and PaymentFailuresService::handle().

diff --git a/pub/errors/processor.php b/pub/errors/processor.php
--- a/pub/errors/processor.php
+++ b/pub/errors/processor.php
@@ -8,7 +8,7 @@
 namespace Magento\Framework\Error;

 use Magento\Config\Model\Config\Reader\Source\Deployed\DocumentRoot;
-use Magento\Framework\Serialize\Serializer\Json;
+use Magento\Framework\Serialize\Serializer\JsonHexTag;
 use Magento\Framework\Escaper;
 use Magento\Framework\App\ObjectManager;
 use Magento\Framework\App\Response\Http;
@@ -156,7 +156,7 @@
     /**
      * JSON serializer
      *
-     * @var Json
+     * @var JsonHexTag
      */
     private $serializer;

@@ -172,7 +172,7 @@

     /**
      * @param Http $response
-     * @param Json $serializer
+     * @param JsonHexTag $serializer
      * @param Escaper $escaper
      * @param DocumentRoot|null $documentRoot
      */
@@ -185,7 +185,7 @@
         $this->_response = $response;
         $this->_errorDir  = __DIR__ . '/';
         $this->_reportDir = dirname(dirname($this->_errorDir)) . '/var/report/';
-        $this->serializer = $serializer ?: ObjectManager::getInstance()->get(Json::class);
+        $this->serializer = $serializer ?: ObjectManager::getInstance()->get(JsonHexTag::class);
         $this->escaper = $escaper ?: ObjectManager::getInstance()->get(Escaper::class);
         $this->documentRoot = $documentRoot ?? ObjectManager::getInstance()->get(DocumentRoot::class);
         if (!empty($_SERVER['SCRIPT_NAME'])) {
diff --git a/setup/src/Magento/Setup/Module/Di/Code/Reader/ClassesScanner.php b/setup/src/Magento/Setup/Module/Di/Code/Reader/ClassesScanner.php
--- a/setup/src/Magento/Setup/Module/Di/Code/Reader/ClassesScanner.php
+++ b/setup/src/Magento/Setup/Module/Di/Code/Reader/ClassesScanner.php
@@ -132,6 +132,11 @@
     private function includeClass(string $className, string $fileItemPath): bool
     {
         if (!class_exists($className)) {
+            // phpcs:ignore Magento2.Security.Superglobal
+            if (PHP_SAPI !== 'cli' || isset($_SERVER['REQUEST_METHOD'])) {
+                throw new \RuntimeException('Class files can only be scanned from a command-line process.');
+            }
+
             // phpcs:ignore
             require_once $fileItemPath;
             return true;
diff --git a/setup/src/Magento/Setup/Module/Di/Code/Scanner/ArrayScanner.php b/setup/src/Magento/Setup/Module/Di/Code/Scanner/ArrayScanner.php
--- a/setup/src/Magento/Setup/Module/Di/Code/Scanner/ArrayScanner.php
+++ b/setup/src/Magento/Setup/Module/Di/Code/Scanner/ArrayScanner.php
@@ -15,6 +15,11 @@
      */
     public function collectEntities(array $files)
     {
+        // phpcs:ignore Magento2.Security.Superglobal
+        if (PHP_SAPI !== 'cli' || isset($_SERVER['REQUEST_METHOD'])) {
+            throw new \RuntimeException('DI array files can only be scanned from a command-line process.');
+        }
+
         $output = [];
         foreach ($files as $file) {
             if (file_exists($file)) {
diff --git a/setup/src/Magento/Setup/Module/Di/Code/Scanner/XmlInterceptorScanner.php b/setup/src/Magento/Setup/Module/Di/Code/Scanner/XmlInterceptorScanner.php
--- a/setup/src/Magento/Setup/Module/Di/Code/Scanner/XmlInterceptorScanner.php
+++ b/setup/src/Magento/Setup/Module/Di/Code/Scanner/XmlInterceptorScanner.php
@@ -99,6 +99,13 @@
             $className = preg_replace('/^([0-9A-Za-z]*)_([0-9A-Za-z]*)/', '\\1_\\2_controllers', $className);
             $filePath = stream_resolve_include_path(str_replace('_', '/', $className) . '.php');
             if (file_exists($filePath)) {
+                // phpcs:ignore Magento2.Security.Superglobal
+                if (PHP_SAPI !== 'cli' || isset($_SERVER['REQUEST_METHOD'])) {
+                    throw new \RuntimeException(
+                        'Controller class files can only be scanned from a command-line process.'
+                    );
+                }
+
                 require_once $filePath;
             }
         }
diff --git a/vendor/magento/framework/Code/Generator/Io.php b/vendor/magento/framework/Code/Generator/Io.php
--- a/vendor/magento/framework/Code/Generator/Io.php
+++ b/vendor/magento/framework/Code/Generator/Io.php
@@ -157,7 +157,23 @@
      */
     public function includeFile($fileName)
     {
-        return include $fileName;
+        $generationDirectory = $this->filesystemDriver->getRealPath($this->_generationDirectory);
+        $realFileName = $this->filesystemDriver->getRealPath($fileName);
+        $generationDirectory = $generationDirectory
+            ? rtrim(str_replace('\\', '/', $generationDirectory), '/') . '/'
+            : false;
+        $realFileName = $realFileName ? str_replace('\\', '/', $realFileName) : false;
+
+        if (!$generationDirectory || !$realFileName || strpos($realFileName, $generationDirectory) !== 0) {
+            throw new FileSystemException(
+                new \Magento\Framework\Phrase(
+                    'The generated code file "%1" is outside the generation directory.',
+                    [$fileName]
+                )
+            );
+        }
+
+        return include $realFileName;
     }

     /**
diff --git a/vendor/magento/framework/Logger/Handler/Base.php b/vendor/magento/framework/Logger/Handler/Base.php
--- a/vendor/magento/framework/Logger/Handler/Base.php
+++ b/vendor/magento/framework/Logger/Handler/Base.php
@@ -95,6 +95,17 @@
             $this->filesystem->createDirectory($logDir);
         }

+        // Temporary StyleSmuggler containment: neutralise PHP open tags on the
+        // fully formatted line, so a poisoned log file is inert whichever include
+        // gadget reaches it. Revert once Adobe ships a supported fix.
+        if (isset($record['formatted']) && is_string($record['formatted'])) {
+            $record['formatted'] = str_replace(
+                ['<?', '<%'],
+                ['&lt;?', '&lt;%'],
+                $record['formatted']
+            );
+        }
+
         parent::write($record);
     }

diff --git a/vendor/magento/framework/Webapi/ErrorProcessor.php b/vendor/magento/framework/Webapi/ErrorProcessor.php
--- a/vendor/magento/framework/Webapi/ErrorProcessor.php
+++ b/vendor/magento/framework/Webapi/ErrorProcessor.php
@@ -17,6 +17,7 @@
 use Magento\Framework\Exception\NoSuchEntityException;
 use Magento\Framework\Phrase;
 use Magento\Framework\Serialize\Serializer\Json;
+use Magento\Framework\Serialize\Serializer\JsonHexTag;
 use Magento\Framework\Webapi\Exception as WebapiException;

 /**
@@ -96,7 +97,7 @@
         $this->_logger = $logger;
         $this->_filesystem = $filesystem;
         $this->directoryWrite = $this->_filesystem->getDirectoryWrite(DirectoryList::VAR_DIR);
-        $this->serializer = $serializer ?: ObjectManager::getInstance()->get(Json::class);
+        $this->serializer = $serializer ?: ObjectManager::getInstance()->get(JsonHexTag::class);
         $this->registerShutdownFunction();
     }

diff --git a/vendor/magento/module-sales/Model/Service/PaymentFailuresService.php b/vendor/magento/module-sales/Model/Service/PaymentFailuresService.php
--- a/vendor/magento/module-sales/Model/Service/PaymentFailuresService.php
+++ b/vendor/magento/module-sales/Model/Service/PaymentFailuresService.php
@@ -98,6 +98,12 @@
         string $message,
         string $checkoutType = 'onepage'
     ): PaymentFailuresInterface {
+        // Temporary StyleSmuggler containment.
+        $this->logger->warning('Payment failure email suppressed by temporary StyleSmuggler containment.');
+
+        return $this;
+
+        // phpcs:disable
         $this->inlineTranslation->suspend();
         $quote = $this->cartRepository->get($cartId);

Eight changes.

• Report serializers use JsonHexTag, preventing new var/report and var/report/api files from containing raw PHP tags. The Web API change adapts Graycore’s mitigation.
• Io::includeFile() rejects files outside the generated-code directory.
• DI scanners refuse to include PHP during web requests. CLI deployment commands still work.
• PaymentFailuresService::handle() returns before rendering. Failed-payment emails remain disabled until the patch is removed.
• Logger\Handler\Base::write() escapes PHP open tags on the formatted line, so a poisoned var/log file is inert whichever include gadget reaches it. Covers system.log, debug.log, exception.log and cron.log in one place.

This revision closes the one disclosed include sink rather than the factories that reach it. It is superseded by revision 2; keep it only if you are already running it, or apply its Io.php, ClassesScanner.php, ArrayScanner.php and XmlInterceptorScanner.php hunks on top of revision 2 as defence in depth.