Magento & Adobe Commerce Vulnerability Lets Hackers Run Code Without Login

A newly uncovered vulnerability in both Magento Open Source and Adobe Commerce has enabled attackers to run arbitrary code on online store servers without logging in. The flaw, identified as StyleSmuggler, was first disclosed by Dutch e‑commerce security company Sansec on September 5 after they detected attacks starting the day prior. The advisory warned that the bug allows malicious payloads to be executed directly on a server’s backend when an attacker crafts specifically crafted requests, bypassing standard login procedures entirely. ¹

StyleSmuggler stems from insufficient input sanitization within the storefront’s theme application process. When a store loads its front-end templates, the system fails to properly escape or validate user-supplied data, letting attackers inject executable code into the rendering pipeline. This mirrors earlier templating engine exploits such as those seen against Drupal 7 sites back in 2013, where insecure