disrex-group/stylesmuggler-adobe-patches-mageoscomposer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion to stylesmuggler-adobe-patches (Magento).
composer require delivery of Adobe's official APSB26-146 fix (CVE-2026-75650, internal
reference VULN-39341) for Mage-OS stores, applied through cweagans/composer-patches.
This is the Mage-OS companion to disrex/stylesmuggler-adobe-patches (that one is for Magento Open Source). Use this one only on Mage-OS.
Prefer a Mage-OS release with the fix. Mage-OS ships its own security releases. If one that contains the APSB26-146 fix is available for your line, update to it instead. This package is for a Mage-OS store that must patch in place until then.
composer require disrex/stylesmuggler-adobe-patches-mageos
composer -o install
There is one release per Mage-OS line, keyed on mage-os/product-community-edition. Composer
picks the one matching your installed Mage-OS version.
| Release (tag) | Mage-OS version | Magento equivalent |
|---|
2.4.6 | >=1.0.0 <1.0.3 | 2.4.6 |
2.4.7 | >=1.0.3 <1.1.0 | 2.4.7 |
2.4.8 | >=1.1.0 <3.0.0 | 2.4.8 |
2.4.9 | >=3.0.0 <4.0.0 | 2.4.9 |
These are Adobe's Magento patches, applied to Mage-OS's packages. The files they touch are
identical between Magento and Mage-OS at the levels we checked: the framework patch applies
cleanly to mage-os/framework 2.3.0 (Magento 2.4.8-p5) and 3.4.0 (Magento 2.4.9), and neither
carried the fix already.
Other Mage-OS versions and the non-framework packages are not individually tested. This is
safe: patches apply through git apply, which is strict. It applies only where the surrounding
lines match exactly, and refuses otherwise; it cannot land a security patch in the wrong place.
Keep "composer-exit-on-patch-failure": true so a refusal stops your deploy with a clear
message. If it refuses, update to a Mage-OS release with the fix.
cweagans/composer-patches. Required. On v2 the patches apply automatically; on v1 also
set "enable-patching": true under extra in your root composer.json."config": { "allow-plugins": { "cweagans/composer-patches": true } }."composer-exit-on-patch-failure": true under extra.composer require never downgrades or reinstalls an installed, locked package on its own. The
release for your line accepts the version you already run, so Composer keeps Mage-OS exactly
where it is and only adds this metapackage and cweagans/composer-patches. A version with no
matching release fails and reverts rather than changing anything.
Adobe's fix for CVE-2026-75650 (CWE-1336, template-engine injection, CVSS 10.0), keyed on
mage-os/framework, mage-os/module-backend, mage-os/module-email,
mage-os/module-newsletter and mage-os/magento2-base. The patch files are Adobe's VULN-39341,
repackaged by yellowteak, referenced by URL
with sha256. The patch content is Adobe's, not covered by this package's MIT license.
Patching shuts the door; it does not evict an attacker who already got in or invalidate secrets they read. Rotate the encryption key, database and admin credentials, API tokens and payment-gateway keys, and work through the cleanup guide in the mitigation repo.
The fix is Adobe's (APSB26-146). The composer-patches repackaging is
yellowteak's. Discovery and the original
advisory belong to Sansec.