CVE-2026-75650

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

Critical Known exploited

Severity: 10.0 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 3.95%; Chance of exploitation in the next 30 days. Higher than 90.42% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since Sep 8, 2026
Weakness: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Fix: None yet; No fixed version published

Exploited in the wild. Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (Adobe Commerce and Magento). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Sep 11, 2026.

Description

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 10.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

How to prevent it

Architecture and Design: Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
Implementation: Use the template engine's sandbox or restricted mode, if available.

References

Advisories

Timeline

Sep 7, 2026 Published
Sep 8, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Sep 11, 2026 Remediation due for U.S. federal agencies
Oct 28, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-27vj-qcqg-25rc fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution	High	Same weakness, CWE-1336
DRUPAL-CONTRIB-2026-175 The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.	Critical	Same weakness, CWE-1336
GHSA-73mf-m39p-wpm9 Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)	Critical	Same weakness, CWE-1336
GHSA-6wvf-77m9-58rm LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint	Critical	Same weakness, CWE-1336
GHSA-x67c-8pwr-m8g3 SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel	High	Same weakness, CWE-1336
GHSA-2c4f-86xc-cr74 Grav: XSS Blueprint Validation Bypass via Twig String Concatenation	Medium	Same weakness, CWE-1336
GHSA-65p8-9433-jpcp YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates	High	Same weakness, CWE-1336
GHSA-f74w-488g-8x5r Craft CMS: Potential authenticated Remote Code Execution via referrer redirect	High	Same weakness, CWE-1336

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor