Why Mage-OS is in scope
Mage-OS distributes a community build of the Magento framework. When the framework carries a template engine flaw, the derivative build carries it too. That is what happened with CVE-2026-103849, the BlockStrap second-pass directive injection that NVD maps to CWE-1336 and scores 10.0 under CVSS 3.1.
Sansec states that Mage-OS is affected up to 3.5.0. Mage-OS 3.6.0, released on 14 October 2026, contains Adobe's fix.
The upgrade is a metapackage change
Because the fix spans the framework package and four modules, upgrading a single package is not enough. Sansec's recommended sequence uses the community edition metapackage so Composer resolves the set together:
composer require mage-os/product-community-edition 3.6.0 --no-update
composer update
The --no-update step pins the metapackage version before resolution, which keeps composer update from choosing a different combination of framework and modules. The same pattern applies on Adobe Commerce, where the fix arrives with the 2026-oct release or the isolated patch rather than as a standalone framework bump.
What the flaw does on a Mage-OS store
The mechanism is identical to the Adobe Commerce case. Attacker-controlled data in a child email template cannot process a {{block}} directive and returns it unchanged. The engine signs that text during the nested render, and the root filter rescans it, dispatching the directive. The September VULN-39341 hotfix closed an earlier route in the same engine but not this one.
Sansec reproduced four routes to code execution within 24 hours of the vendor patch and reported no attacks on live stores when it published its analysis on 15 October 2026. The public validation lab documents an unauthenticated carrier built from guest GraphQL operations and a stock file side effect, and is explicit that it does not demonstrate a stock full chain in the tree it examined.
Verification on Mage-OS paths
The verification command changes path, not logic. On Mage-OS, check vendor/mage-os/framework/Filter/Template.php for resolveDeferredDirectives with the same grep -c approach Sansec recommends for the Adobe path. A zero means the fix is missing.
Two further checks matter. Confirm the StyleSmuggler hotfix VULN-39341 is still installed, because the October fix does not include it and Adobe's patch registry does not list it as a prerequisite. And confirm which artifact serves traffic, since a container image or a blue-green pair can carry a patched build on one side and an unpatched one on the other.
The wider scheduling question
Mage-OS releases on its own cadence, and that cadence may not match a merchant's maintenance window. When a derivative distribution ships a critical fix days after the upstream vendor, administrators face the same trade-off they face on the vendor release: patch on the vendor's timeline, or accept risk with an HTTP-layer control in front of the application.
Sansec offers its own shield product as an interim control and states its rules are live for covered stores. Any equivalent rule needs testing against the store's checkout flow, because a rule that blocks legitimate guest orders is its own outage.