disrex-group/stylesmuggler-adobe-patchescomposer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Magento, via cweagans/composer-patches. Auto-selects the patch for your Magento version.
A Composer plugin that applies Adobe's official APSB26-146 fix (CVE-2026-75650, internal reference VULN-39341) for the StyleSmuggler zero-day to Magento Open Source and Mage-OS, automatically, detecting your installed version.
It patches the installed packages itself on install and update. It does not rely on
cweagans/composer-patches or a root enable-patching flag, so it cannot silently do nothing
the way a dependency patch does on composer-patches v1.
Prefer a release that already contains the fix. If you can move to a Magento or Mage-OS release that ships APSB26-146, do that. This plugin is for a store that must patch in place.
composer require disrex/stylesmuggler-adobe-patches
You must allow the plugin, or nothing is patched. Because this is a Composer plugin, Composer 2.2 and later ask:
Do you trust "disrex/stylesmuggler-adobe-patches" to execute code and wish to enable it now? [y,n,d,?]
Answer y. If you answer , or run non-interactively (CI, ) without
allowing it first, Composer skips the plugin and To allow it
ahead of time (required for CI and deploys), add this to your root before
installing:
n--no-interactioncomposer.json"config": { "allow-plugins": { "disrex/stylesmuggler-adobe-patches": true } }
On the next composer install or composer update the plugin applies the patch and prints what
it did:
StyleSmuggler (APSB26-146): applying magento_framework.patch
...
✅ StyleSmuggler (APSB26-146) patched: Magento 2.4.8.
On post-install-cmd and post-update-cmd it:
magento/product-community-edition (Magento) or
mage-os/product-community-edition (Mage-OS), falling back to magento/framework.framework, module-backend, module-email, module-newsletter
and the error-report processor, under the right vendor (magento/ or mage-os/).It is idempotent: an already-patched store reports already applied and nothing changes.
patch is strict. A hunk applies only where the surrounding lines match exactly, so the
fix cannot land in the wrong place. On a version it was not built against, a mismatch is
reported as a loud error, not applied silently and not hidden.Adobe's patch is built per Magento patch level; this plugin ships all of them and picks by your
version. Verified end to end on Magento 2.4.8, and the framework patch verified against Mage-OS
framework 2.3.0 (Magento 2.4.8-p5) and 3.4.0 (Magento 2.4.9). Other patch levels rely on
patch's strictness: they apply where the files are unchanged and report a mismatch otherwise.
| Magento line | Adobe patch built against |
|---|---|
| 2.4.4 | 2.4.4-p18 |
| 2.4.5 | 2.4.5-p17 |
| 2.4.6 | 2.4.6-p15 |
| 2.4.7 | 2.4.7-p10 |
| 2.4.8 | 2.4.8-p5 |
| 2.4.9 | 2.4.9 |
Mage-OS lines map to these by the Magento version they track.
composer remove disrex/stylesmuggler-adobe-patches
This stops re-applying the patch. It does not revert files already patched; move to a release that contains the fix and reinstall to get clean vendor files.
Patching shuts the door; it does not evict an attacker who already got in or invalidate secrets they read. If you found any indicator of compromise, rotate the encryption key, database and admin credentials, API tokens and payment-gateway keys, and work through the cleanup guide in the mitigation repo.
The fix is Adobe's (APSB26-146). The patch files under patches/ are Adobe's VULN-39341,
repackaged for per-package application by
yellowteak. Discovery and the original
advisory belong to Sansec. This plugin's own code is MIT; the patch
content under patches/ is Adobe's, not covered by that license.