cve-2026-103849-blockstrap-lab

It is a reproduction lab for CVE-2026-103849 (BlockStrap), an unauthenticated {{block}} template-directive injection issue in Magento 2.4.9 reached through guest GraphQL. ^[1a][1b] It helps someone compare vulnerable and patched Magento states to see whether the {{block}} directive remains inert after the APSB26-153 fix. ^[2a][2b] A concrete use case is the included guest GraphQL probe, which captures a failed-payment email and checks for CUSTOM_BLOCK_ in the vulnerable state but not the patched state. ^[3a][3b]